Fix publish: use npm OIDC trusted publishing

[milldr]

Summary

• Remove registry-url from setup-node — it was injecting GITHUB_TOKEN as NODE_AUTH_TOKEN, overriding OIDC auth
• Upgrade npm to latest (>=11.5) in CI — OIDC trusted publishing auth requires npm 11.5+
• Remove NODE_AUTH_TOKEN env — OIDC handles authentication, no token needed

Test plan

• Merge, delete failed v0.2.0 release/tag, publish new release
• Verify npm publish succeeds without any npm token secret