NPM package publishing via Trusted Publishing

[hillna]

Changelog

None

Docs

None

Description

Updates NPM publishing to use Trusted Publishing since classic tokens are being deprecated.

---

Note

Move TypeScript package publishing to NPM Trusted Publishing via OIDC, adding required permissions and removing classic token usage.

• CI workflow (.github/workflows/ci.yml):
  • TypeScript job:
    • Add permissions.contents: read alongside id-token: write for OIDC.
    • Configure actions/setup-node with registry-url for NPM.
    • Remove NODE_AUTH_TOKEN env from all npm publish steps for @mcap/{core,support,nodejs,browser} (Trusted Publishing).
    • Keep npm publish ... --provenance --access public steps gated by tag refs.

^{Written by Cursor Bugbot for commit fdd1121. This will update automatically on new commits. Configure here.}

[linear]

INF-64 Migrate foxglovebot npm tokens to new access tokens

[hillna]

Trusted Publishing did not work correctly when tested in create-foxglove-extensions:

https://github.com/foxglove/create-foxglove-extension/actions/runs/19973666664

Moving this to draft while I debug Trusted Publishing and fall back to updating the NPM tokens to Granular for the time being.