publish_npm: use Trusted Publishing (OIDC) for auth, not NPM_TOKEN (#700)

Trusted Publishing is now configured on npmjs.org for theengs-decoder
(repo: theengs/decoder, workflow: publish_npm.yml). The v2.3.0 publish
still returned 404 because:

- Node 20 ships with npm 10.x, which only uses OIDC for provenance
  attestation. Authentication still relied on NODE_AUTH_TOKEN, and the
  NPM_TOKEN secret is no longer valid, so PUT was rejected.
- Full OIDC auth for npm publish requires npm 11.5.1+.

Upgrade npm to latest before publishing, and drop the NODE_AUTH_TOKEN
env from the publish steps so the CLI uses the Trusted Publisher flow
end-to-end. The NPM_TOKEN secret can be removed from the repo once
this lands.

Co-authored-by: Florian <1technophile@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 1technophile

.github/workflows/publish_npm.yml

@@ -28,6 +28,9 @@ jobs:
         node-version: '20'
         registry-url: 'https://registry.npmjs.org'
 
+    - name: Upgrade npm for Trusted Publishing
+      run: npm install -g npm@latest
+
     - name: Set up Emscripten
       uses: mymindstorm/setup-emsdk@v14
       with:
@@ -70,12 +73,8 @@ jobs:
 
     - name: Publish theengs-decoder to npm
       working-directory: nodejs/theengs-decoder
-      env:
-        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
       run: npm publish --provenance --access public
 
     - name: Publish node-red-contrib-theengs-decoder to npm
       working-directory: nodejs/node-red-contrib-theengs-decoder
-      env:
-        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
       run: npm publish --provenance --access public