ci(release): switch publish step to npm trusted publishing

.changeset/add-release-environment.md

@@ -0,0 +1,5 @@
+---
+"@deessejs/errors": patch
+---
+
+Tag the release job with `environment: release` so the run is recorded as a deployment to the `release` GitHub environment. Future hardening (required reviewers, branch restrictions, wait timer) can attach to the same environment without further workflow changes. Provenance and trusted publishing are unaffected.

.changeset/switch-to-trusted-publishing.md

@@ -0,0 +1,5 @@
+---
+"@deessejs/errors": patch
+---
+
+Switch the release workflow to npm trusted publishing (OIDC) instead of `secrets.NPM_TOKEN`. The `id-token: write` permission, already declared on the job, is sufficient for GitHub to mint the OIDC token that npm exchanges for a short-lived publish credential. Provenance is generated automatically on public repos. The `NPM_TOKEN` secret can be revoked once the first OIDC publish succeeds.

.github/workflows/release.yml

@@ -26,6 +26,7 @@ jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
+    environment: release
     # Run when a PR is merged into main OR manually triggered
     if: |
       github.event_name == 'workflow_dispatch' ||
@@ -84,8 +85,6 @@ jobs:
 
       - name: Publish packages
         if: steps.detect.outputs.has_changesets == 'true' && (github.event_name == 'workflow_dispatch' || inputs.dry_run != true)
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           if [ -n "${{ inputs.packages }}" ]; then
             pnpm changeset publish --packages=$(echo "${{ inputs.packages }}" | tr ',' ' ')