fix: 🐛 publish to npm via OIDC trusted publishing

npm revoked 2FA-bypass automation tokens, which failed every publish of
8.2.1 with a masked 404. The release job now relies on the trusted
publisher configured on npmjs.com. The OIDC path in @semantic-release/npm
only engages on the exact https://registry.npmjs.org/ host, so every
publishConfig moves off the .com alias, and the Publish step drops the
deleted NPM_TOKEN secret in favor of the id-token permission.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: prc5

.github/workflows/workflow.yml

@@ -129,11 +129,13 @@ jobs:
       - name: Get latest tag before release
         id: pre_release_tag
         run: echo "tag=$(git describe --tags --abbrev=0 || echo 'none')" >> $GITHUB_OUTPUT
+      # npm auth comes from trusted publishing (OIDC): the id-token permission above lets
+      # semantic-release exchange the Actions identity for a publish token. No NPM_TOKEN.
+      # Requires the registry to be https://registry.npmjs.org/ (the .org host, exactly).
       - name: Publish
         run: pnpm release
         env:
           GITHUB_TOKEN: ${{ github.token }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
       - name: Get latest tag after release
         id: post_release_tag
         run: |

packages/adapter-axios/package.json

@@ -21,7 +21,7 @@
   },
   "publishConfig": {
     "access": "public",
-    "registry": "https://registry.npmjs.com/"
+    "registry": "https://registry.npmjs.org/"
   },
   "repository": {
     "type": "git",

packages/adapter-firebase-admin/package.json

@@ -23,7 +23,7 @@
   },
   "publishConfig": {
     "access": "public",
-    "registry": "https://registry.npmjs.com/"
+    "registry": "https://registry.npmjs.org/"
   },
   "repository": {
     "type": "git",

packages/adapter-firebase/package.json

@@ -23,7 +23,7 @@
   },
   "publishConfig": {
     "access": "public",
-    "registry": "https://registry.npmjs.com/"
+    "registry": "https://registry.npmjs.org/"
   },
   "repository": {
     "type": "git",

packages/adapter-graphql/package.json

@@ -33,7 +33,7 @@
   },
   "publishConfig": {
     "access": "public",
-    "registry": "https://registry.npmjs.com/"
+    "registry": "https://registry.npmjs.org/"
   },
   "repository": {
     "type": "git",

packages/cli/package.json

@@ -26,7 +26,7 @@
   },
   "publishConfig": {
     "access": "public",
-    "registry": "https://registry.npmjs.com/"
+    "registry": "https://registry.npmjs.org/"
   },
   "repository": {
     "type": "git",

packages/core/package.json

@@ -21,7 +21,7 @@
   },
   "publishConfig": {
     "access": "public",
-    "registry": "https://registry.npmjs.com/"
+    "registry": "https://registry.npmjs.org/"
   },
   "repository": {
     "type": "git",

packages/hyper-flow/package.json

@@ -124,7 +124,7 @@
   },
   "publishConfig": {
     "access": "public",
-    "registry": "https://registry.npmjs.com/"
+    "registry": "https://registry.npmjs.org/"
   },
   "repository": {
     "type": "git",

packages/plugin-devtools/package.json

@@ -43,7 +43,7 @@
   },
   "publishConfig": {
     "access": "public",
-    "registry": "https://registry.npmjs.com/"
+    "registry": "https://registry.npmjs.org/"
   },
   "repository": {
     "type": "git",

packages/plugin-eslint/package.json

@@ -47,7 +47,7 @@
   },
   "publishConfig": {
     "access": "public",
-    "registry": "https://registry.npmjs.com/"
+    "registry": "https://registry.npmjs.org/"
   },
   "repository": {
     "type": "git",