ci: migrate npm publishing to OIDC

[owjs3901]

Summary

• switch changepacks Node.js publish and dry-run commands from Bun to npm, because npm CLI supports Trusted Publishing OIDC and Bun does not
• grant the publish job explicit least-required GitHub permissions, including id-token: write
• remove NPM_TOKEN / NODE_AUTH_TOKEN / NPM_CONFIG_TOKEN from the workflow
• retain npm's automatic provenance for public packages

Required before merge

Configure a Trusted Publisher for every publishable package on npmjs.com with:

• Provider: GitHub Actions
• Organization: dev-five-git
• Repository: devup-ui
• Workflow filename: publish.yml
• Environment: leave empty
• Allowed action: npm publish

There are 11 packages to configure. @devup-ui/eslint-plugin@1.0.16 is already published, but it still needs the Trusted Publisher for future releases. Do not merge this PR until all 11 entries are configured; merging triggers the pending ten-package release from main.

Verification

• actionlint 1.7.12 .github/workflows/publish.yml
• bun run build
• bun run lint (0 errors; 21 existing warnings)
• bun run test (5,135 passed, 0 failed)
• changepacks npm publish --dry-run for the 10 pending release candidates (10/10 succeeded)
• commit hook repeated lint and the 5,135-test suite successfully

No changepack: this changes CI authentication only and does not change a published package API or runtime artifact.

npm package checklist

• @devup-ui/wasm
• @devup-ui/plugin-utils
• @devup-ui/react
• @devup-ui/next-plugin
• @devup-ui/vite-plugin
• @devup-ui/webpack-plugin
• @devup-ui/rsbuild-plugin
• @devup-ui/bun-plugin
• @devup-ui/components
• @devup-ui/reset-css
• @devup-ui/eslint-plugin

[github-actions]

Changepacks

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.