configure trusted publishing for npm publish CI action

[gitcommitshow]

The npm publishing process now fails because the older auth process has been deprecated.
Use trusted publisher method, I couldn't find this option for now.

Reference: https://docs.npmjs.com/trusted-publishers

[gitcommitshow]

Updated github action as mentioned in the guide but it still does not work.
A persistent failure with npm trusted publishing using GitHub Actions (OIDC).

Error observed when GitHub action for publishing runs:

npm notice Access token expired or revoked. Please try logging in again.
npm error 404 Not Found - PUT https://registry.npmjs.org/resilient-llm
npm error 404 'resilient-llm@1.3.1' is not in this registry

Details:

• GitHub action logs
• Workflow file code
• Package already exists; version being published does not exist
• Publishing fails both via workflow_dispatch and via a published GitHub release
• GitHub Actions job has permissions: id-token: write
• Using actions/setup-node@v4 with the npm registry
• No NODE_AUTH_TOKEN is set
• Workflow path, repo, and package name all match the trusted publisher configuration

Additional info from the workflow logs:

event=workflow_dispatch
ref=refs/heads/main
workflow_ref=<owner>/<repo>/.github/workflows/publish.yml@refs/heads/main

Given that both manual and release-based publishing fail with trusted publishing enabled, this appears to be a bug with the trusted publisher binding or OIDC validation for this package.

[gitcommitshow]

Others faced similar issue npm/cli#8730

This workaround fixed it (thanks @joeyparrish)

• update to node 24 (not documented, and contradicting examples from npm docs that use node 20)
• update npm to 11.5.1+ (I was already using that)
• set matching repository.url in package.json (not documented, and relevant to forks that have only changed the package name)