ci(release): move npm publishing to trusted publishing and scope workflow permissions #161

.github/workflows/release.yml:66 publishes with a long-lived NPM_TOKEN, and grants workflow-wide write permissions to the lint, test and build jobs.

• Configure the npm trusted publisher and publish with id-token: write and --provenance.
• Delete the NPM_TOKEN secret.
• Set permissions: contents: read at the workflow level and grant write only to the publish job.

Same change in seamless-auth-oidc-provider and seamless-auth-messaging. Related: fells-code/seamless-auth-api#438.

Source

Internal security review of 2026-11-09 (L-OPS-2), read at 6fbb9cd. Found by reading code; nothing was executed. Status: Reported.