ci: migrate npm publishing to Trusted Publishers (eliminate static NPM_TOKEN)

[Copilot]

Replaces static NPM_TOKEN secret with npm Trusted Publishers (OIDC keyless publishing) in the reusable release workflow. The id-token: write permission and --provenance flag were already in place; this removes the last dependency on the static token.

Changes

• Remove NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} from publish-npm step — setup-node with registry-url + OIDC handles auth automatically
• Update step comments to document the Trusted Publishers auth model
• Add docs/NPM-TRUSTED-PUBLISHERS.md — setup guide for configuring each @plures/* package on npmjs.org

Required manual step (per-package, one-time)

Each package must be configured on npmjs.org:

Settings → Publishing access → Add trusted publisher
Repository: plures/.github | Workflow: release-reusable.yml | Environment: (blank)

Without this, npm publish will 403. Packages should be configured before merging this change or coordinated with the next release cycle.

• Fixes Migrate npm publishing to Trusted Publishers (eliminate static NPM_TOKEN) #12