fix(ci): harden release workflows — Node 24, permissions, registry-url

- Add `permissions: contents: read / id-token: write` to both release
  jobs; id-token:write is required for npm provenance (SLSA attestation)
- Upgrade node-version from 22.x to 24 to match the org-wide publish
  standard and stay ahead of Node 22 LTS EOL
- Add `registry-url: https://registry.npmjs.org/` to setup-node so the
  runner writes a proper .npmrc with NODE_AUTH_TOKEN wired up for any
  plain `npm` calls in the job

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: cs-raj

.github/workflows/release-production-core.yml

@@ -6,14 +6,18 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
         with:
           version: 10.28.0
       - uses: actions/setup-node@v4
         with:
-          node-version: '22.x'
+          node-version: '24'
+          registry-url: https://registry.npmjs.org/
 
       - name: Enable Corepack
         run: corepack enable

.github/workflows/release-production-platform-plugins.yml

@@ -6,14 +6,18 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
         with:
           version: 10.28.0
       - uses: actions/setup-node@v4
         with:
-          node-version: '22.x'
+          node-version: '24'
+          registry-url: https://registry.npmjs.org/
 
       - name: Enable Corepack
         run: corepack enable