ci(npm): OIDC/Trusted publishing workflow & node update

[turbobobbytraykov]

Description

This is one of the few remaining repos where we don't have Trusted Publishing to npmjs.org.
I have enabled Trusted Publishing for each package being published from this repo - I believe that publishing a new rc #4 is the best way to try this out.

Related Issue

Closes #

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring / code cleanup
• Build / CI configuration change

Affected Packages

• igniteui-cli (packages/cli)
• @igniteui/cli-core (packages/core)
• @igniteui/angular-templates (packages/igx-templates)
• @igniteui/angular-schematics (packages/ng-schematics)
• @igniteui/mcp-server (packages/igniteui-mcp)

Checklist

• I have tested my changes locally (npm run test)
• I have built the project successfully (npm run build)
• I have run the linter (npm run lint)
• I have added/updated tests as needed
• My changes do not introduce new warnings or errors

Additional Context

[turbobobbytraykov]

@damyanpetev , according to the initial official docs for Trusted Publishing:
https://docs.npmjs.com/trusted-publishers

My concern is that we are currently using node 20 - for this version npm can be updated to v 11.12.1 , so at least npm is OK and I hope that that's sufficient.

[Copilot]

Pull request overview

Updates the npm publish GitHub Actions workflow to use npmjs.org Trusted Publishing (OIDC) instead of an NPM_TOKEN, aligning this repo with the newer publishing model for the listed packages.

Changes:

• Grants id-token: write so the workflow can request an OIDC token for npm Trusted Publishing.
• Updates npm in the runner prior to publishing.
• Removes NODE_AUTH_TOKEN injection (token-based auth) from the publish step.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Consider scoping id-token: write to the specific job (or even the publishing step via job-level permissions) instead of workflow-wide permissions. This keeps least-privilege if additional jobs are added later.

[coveralls]

coverage: 86.279%. remained the same — btraykov/update-npm-for-npmjs-oidc into master