ci: tighten default token scope

[kody-bot]

Why

@kentcdodds asked me to open this PR after reviewing the npm supply-chain risk described in the TanStack postmortem: https://tanstack.com/blog/npm-supply-chain-compromise-postmortem

This repository already uses npm trusted publishing/OIDC for semantic-release, so this hardens the workflow by keeping package build/dependency execution out of the privileged publishing job where feasible.

What changed

• Build the package in an unprivileged job and upload the package output as a short-lived artifact.
• Keep the release job focused on downloading the prebuilt artifact and running semantic-release with OIDC permissions.
• Default workflow token permissions to read-only where the workflow did not already do so.

Notes

This follows the same pattern Kent has been applying to his own semantically-released trusted-publishing packages.

[mcous]

I already had this workflow set up to separate the build step from the privileged publish flow. Adjusted PR title accordingly

CI failures are unrelated and due to drift in dev dependency versions - will fix this separately