Migrate npm publishing to OIDC (master-v54)

[pomek]

🚀 Summary

Migrates the release workflow from the long-lived CKE5_NPM_TOKEN to npm Trusted Publishing with CircleCI OIDC.

The PR also:

• Installs npm ^11.11.0 in the release job because the cimg/node:24.11.0 image ships an npm version whose OIDC implementation does not recognize CircleCI (support was added in feat: adds circleci to oidc npm/cli#8925, first released in npm 11.11.0).
• Configures releaseTools.publishPackages() to use OIDC (useOidc: true) and removes the login-based npmOwner option, as npm whoami does not support OIDC authentication.
• Switches the origin remote to SSH and pins GitHub's published Ed25519 host key so the release commit and tag can be pushed from the GitHub App checkout without an interactive prompt.
• Adds a focused script test verifying the OIDC option and the absence of npmOwner.

The trigger command already passes --pipeline-definition-id, so no trigger changes were needed. The changes mirror the Mrgit and Umberto migrations driven by ckeditor/ckeditor5-internal#4432.

This is the master-v54 port of the same change (the release publishes with --npm-tag latest-v54).

---

📌 Related issues

• See https://github.com/ckeditor/ckeditor5-internal/issues/4654.

---

💡 Additional information

This is an internal CI change, so no changelog entry is required. ESLint and script tests pass locally, and the trusted publisher configuration inputs (organization, project, and pipeline definition IDs) were verified against the CircleCI API. The workspace @ckeditor/ckeditor5-dev-release-tools already provides useOidc on this branch. Before the first release on this flow, trusted publishers for all published packages must be configured on npm, and a release after merge is required to validate the OIDC exchange with npm end to end.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2230b5e. Configure here.}