Trusted Publishing for npm: The Missing Steps the Docs Don’t Spell Out

Fix npm trusted publishing from GitHub Actions after token revocations: add OIDC permission, upgrade npm, and publish with --provenance.