ci: replace npm publish token with trusted publishing

[K-Mistele]

Summary

Replace the failed token-based npm publication with GitHub Actions trusted publishing (OIDC).

• Grant the publish job only contents: read and id-token: write; restrict it to main.
• Use GitHub-hosted runners, Node 24 and pinned npm 11.19.1; disable automatic package-manager caching for release builds.
• Remove the NODE_AUTH_TOKEN: secrets.NPM_TOKEN reference. npm exchanges the job's OIDC token for a short-lived publication credential.
• Document maintainer setup, first release verification and safe retirement of the old token.

No dependency patches, package-version changes, lockfile changes, or library-code changes. skip-version-bump retains the pending 5.4.0 version rather than bumping for this infrastructure-only change.

One-time npm setup

Run with an npm maintainer account with package write access and account-level 2FA enabled:

bunx --package npm@11.19.1 npm login
bunx --package npm@11.19.1 npm trust github @humanlayer/react-hotkeys-hook --repo humanlayer/react-hotkeys-hook --file publish.yml --allow-publish
bunx --package npm@11.19.1 npm trust list @humanlayer/react-hotkeys-hook

The trust configuration uses the workflow filename publish.yml and no environment. No npm credentials need to be copied into GitHub Actions.

After setup and merge, start a new workflow run:

gh workflow run publish.yml --repo humanlayer/react-hotkeys-hook --ref main

Do not rerun the previous failed run, which uses the old token-based workflow revision. After successful OIDC publication, remove the unused repository secret and revoke the old npm token only after checking that other packages do not share it.

Validation

• actionlint .github/workflows/publish.yml: passed.
• Parsed workflow assertions: OIDC/read permissions, main-only guard, pinned CLI, no token references, release cache disabled, and unchanged publish command passed.
• Verified the exact trust command flags with npm 11.19.1 CLI help and official npm documentation.
• Independent read-only review: no findings.
• git diff --check: passed.

Actual OIDC authentication/provenance cannot be verified locally. The first successful hosted publish after maintainer setup is the end-to-end verification. No npm trust settings or existing secrets were modified by this PR.