fix(release): use npm trusted publishing

[routeplane-ops]

The v0.5.0 publish run supplied NODE_AUTH_TOKEN, so pnpm chose the legacy automation token instead of the already-configured npm Trusted Publisher. npm correctly rejected that token under publish-time 2FA. No v0.5.0 package was published.

This change:

• removes the long-lived npm credential and project .npmrc
• isolates build/test/pack from the OIDC-enabled publish job
• publishes only three same-run tarballs with lifecycle scripts disabled
• binds tags to main and all three package versions
• disables release caches and SHA-pins every action
• advances the immutable retry to v0.5.1

Validation:

• pnpm install --frozen-lockfile
• pnpm build
• pnpm test (121 tests)
• pnpm lint
• npm publish --dry-run for all three tarballs
• actionlint
• zizmor (no findings)
• git diff --check
• independent security review: SHIP