Remove NPM_TOKEN from publishing script

[asus4]

No description provided.

[Copilot]

Pull Request Overview

This PR removes the NPM_TOKEN secret authentication in favor of OIDC token-based authentication for NPM package publishing, enhancing security by eliminating the need for long-lived secrets.

• Adds OIDC permissions (id-token: write, contents: read) to enable token-based authentication
• Updates Node.js setup action from v4 to v5 with latest node version
• Removes NODE_AUTH_TOKEN environment variables from all publish steps

Comments suppressed due to low confidence (1)

.github/workflows/publish-packages.yaml:1

• The OIDC authentication setup is incomplete. You need to configure npm with provenance and set up the registry authentication. Add --provenance --access public to npm publish commands and ensure the registry is properly configured for OIDC authentication.

name: Publish UPM packages

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}