build(*): Enable trusted publishing

.github/workflows/release.yml

@@ -14,6 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      id-token: write
       issues: write
       pull-requests: write
 
@@ -35,6 +36,16 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Verify npm trusted publishing auth
+        run: |
+          if [ -n "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ]; then
+            exit 0
+          fi
+
+          echo "Missing GitHub Actions OIDC token for npm trusted publishing."
+          echo "Ensure this workflow keeps the id-token: write permission."
+          exit 1
+
       - name: Typecheck Svelte package
         run: pnpm --filter tech-radar-editor check
 
@@ -44,5 +55,4 @@ jobs:
       - name: Publish packages
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: pnpm release