ci: use npm Trusted Publishing instead of NPM_TOKEN

[TheStreamCode]

Summary

Switch the npm publish workflow to Trusted Publishing (OIDC): drop NODE_AUTH_TOKEN so npm authenticates the run from the id-token permission. Token auth fails with EOTP since classic tokens can no longer publish.

Changes

• .github/workflows/publish.yml: removed NODE_AUTH_TOKEN env + bootstrap comment

Testing

• CI matrix below (workflow file only; publish itself verified by re-running the v2.0.0 release afterwards)

Checklist

• PR is focused on a single concern
• README.md updated if user-facing behavior changed (N/A)
• No API keys or credentials in code or examples
• New provider entries document the base URL, model behavior, and authentication requirements (N/A)
• Credential environment names are registered and tested when authentication is required (N/A)

Notes

• Requires the Trusted Publisher already configured on npmjs.com for this repo + workflow.