Switch npm publishing to trusted publishing (OIDC)

[11bit]

Replaces the long-lived NPM_TOKEN secret with npm trusted publishing (OIDC).

What changed

.github/workflows/publish.yml

• Removed NPM_TOKEN from the changesets/action step env. changesets/action@v1 (currently v1.9.0) only writes an ~/.npmrc auth line if NPM_TOKEN is set; without it, it detects the OIDC env vars and logs No NPM_TOKEN found, but OIDC is available - using npm trusted publishing. @changesets/cli skips its 2FA/whoami path in CI and shells out to npm publish, so the token exchange happens inside the npm CLI.
• id-token: write was already present, so no permission changes were needed.
• Provenance is still generated automatically under trusted publishing — no --provenance flag required.
• Node 18 → 24. Trusted publishing requires npm >= 11.5.1 and Node >= 22.14.0. Node 22.x still ships npm 10.9.x, so it would not have worked; Node 24.20 ships npm 11.19.
• actions/setup-node@v3 → @v4.

.github/workflows/ci.yml

• Same Node 24 bump plus actions/checkout@v4 / actions/setup-node@v4, to keep CI in sync with the release job.

package.json

• Dropped the publish-patch script. Releases are cut by CI via changesets, and a manual local npm publish breaks once trusted publishing is required for the package.

Required manual step before merging

Configure the trusted publisher on npmjs.com for @imgproxy/imgproxy-node (Settings → Trusted Publisher):

Field	Value
Organization or user	imgproxy
Repository	imgproxy-node
Workflow filename	publish.yml
Environment	(leave empty)

Without this entry the next release publish fails to authenticate. Once the first release publishes successfully, the NPM_TOKEN repository secret can be deleted.

Verification

npm run lint, npm run check-types, vitest run (30 tests) and npm run build all pass locally on Node 24.

🤖 Generated with Claude Code

https://claude.ai/code/session_014sCcudHzpuZvLBhZ1U1Uvi