fix(release): publish to npm with NPM_TOKEN until npm accepts immutable OIDC subjects

[taraxvoid]

Trusted publishing fails with 403 OIDC permission denied because this repo issues GitHub's immutable OIDC subject claims (repo:taraxvoid@<id>/voidflow@<id>:...), forced on for repos created or renamed after 2026-07-15 and not switchable. npm's token exchange rejects that format: npm/cli#9969.

• Both publish steps now set NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}. Provenance still works via id-token: write.
• Removes the temporary OIDC claim debug step from ci(release): manual npm republish + OIDC debug #75. The workflow_dispatch manual republish stays.
• Comments explain how to revert to pure OIDC once npm fixes it (delete the secret and the NODE_AUTH_TOKEN lines; the trusted publisher entries are already configured).

Before merging / republishing

1. Create a granular npm access token (read/write, scoped to @taraxvoid/voidflow and voidflow, bypass-2FA for automation).
2. Add it as NPM_TOKEN on the npm GitHub environment (Settings > Environments > npm > Environment secrets).
3. After merge, run Release Please manually (Actions > Run workflow) with tag v0.7.0 to publish it.

🤖 Generated with Claude Code