ci: switch CLI release to npm OIDC trusted publishing

- id-token: write + npm >= 11.5.1, drop the NPM_TOKEN secret
- document the first-publish-must-be-manual npm limitation

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018pJJgDHCnnNeEqEAApxFcQ

Author: Omar Bni

.github/workflows/release-cli.yml

@@ -1,8 +1,14 @@
 # Publishes create-clanker-support to npm. Trigger by pushing a tag:
 #   create-clanker-support@1.0.0
-# Requires an NPM_TOKEN secret (npm automation token with publish rights to the
-# unscoped `create-clanker-support` name). The tag version must match
-# packages/create-clanker-support/package.json — asserted before publish.
+# Auth is OIDC trusted publishing (no token secret): configure a trusted
+# publisher on the npm package (Settings -> Trusted publisher) pointing at
+#   org: theopenco  repo: clankersupport-templates
+#   workflow: release-cli.yml  environment: (none)
+# npm can only add a trusted publisher to an EXISTING package, so the very
+# first publish must be done manually (`npm publish --access public` from
+# packages/create-clanker-support) — every release after that is OIDC.
+# The tag version must match packages/create-clanker-support/package.json —
+# asserted before publish.
 name: Release CLI
 
 on:
@@ -13,6 +19,9 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # OIDC token for npm trusted publishing
     defaults:
       run:
         working-directory: packages/create-clanker-support
@@ -22,6 +31,8 @@ jobs:
         with:
           node-version: 22
           registry-url: https://registry.npmjs.org
+      # Node 22 bundles npm 10; trusted publishing needs npm >= 11.5.1.
+      - run: npm install -g npm@11
       - name: Assert tag matches package version
         run: |
           TAG_VERSION="${GITHUB_REF_NAME#create-clanker-support@}"
@@ -32,5 +43,3 @@ jobs:
         run: node index.mjs --help | grep -q "create-clanker-support"
       - name: Publish
         run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}