[MyPrototypeWhat]

This moves releases from the NPM_TOKEN secret to npm trusted publishing (OIDC). npm is removing direct publish from tokens that bypass 2FA, with January 2027 as the target date. Our CI token is that kind of token, so releases would stop working then.

Change

• release.yml
  • Adds id-token: write to the job.
  • Installs npm 11. Trusted publishing needs npm ≥ 11.5.1. We stay on 11 because changesets 2.x reads npm info --json as an object, and npm 12 returns an array.
  • Drops registry-url and both token env vars. Any _authToken in an .npmrc makes npm skip OIDC.
  • With no NPM_TOKEN, changesets/action v1.9 leaves ~/.npmrc untouched and logs "using npm trusted publishing".
  • changeset publish → pnpm publish → npm publish then exchanges the job's OIDC token. This path is known to work on pnpm 10 (pnpm v11: spawned npm publish no longer reaches npm OIDC trusted publishing pnpm/pnpm#11566). Node stays at 22, matching CI.
• A patch changeset for all 21 published packages. npm expires a new trusted-publisher configuration if it is not used for a successful publish within 2 days. Republishing everything activates every configuration at once. It also gives each package its first signed provenance statement. There are no code changes.
• scripts/trust-publishers.sh. It registers refkitjs/refkit + release.yml as the trusted publisher of every public package, using npm trust github … --allow-publish. Run it once now, and again for any future package after its first manual publish.

Rollout, in this order

1. Merge this PR. The Release job sees the changeset and opens a Version Packages PR. Nothing is published yet.
2. Run npm login, then bash scripts/trust-publishers.sh. On the first 2FA prompt, tick "skip 2FA for 5 minutes" so all 21 go through.
3. Merge the Version Packages PR within 2 days. Release publishes every package through OIDC.
4. Once npm shows the new versions with provenance:
   • delete the NPM_TOKEN repository secret;
   • revoke that token on npmjs.com;
   • optionally set each package to "Require 2FA and disallow tokens".

If step 3 fails, NPM_TOKEN is still there, so restoring the old workflow lines is a one-commit rollback.

Not in this PR

The official changesets flow for trusted publishing (changesets/action v2) splits pack and publish into separate jobs, so only the publish job holds the OIDC permission. It requires changesets CLI v3, which has its own breaking changes, so it is a separate follow-up.