Fix npm publish workflow EOTP failures by preferring GitHub trusted publishing

[Copilot]

The publish GitHub Actions job failed on npm publish with EOTP, blocking release publication of @mitii/* packages. This change updates the publish path to use GitHub OIDC trusted publishing by default, with token-based auth retained as fallback.

• Publish auth flow (script)

  • Updated scripts/publish-npm.cjs to:
    • detect GitHub Actions OIDC context,
    • publish with --provenance under trusted publishing (without token env),
    • retry with token auth only if trusted publish fails and a token is available.
  • Keeps existing non-Actions/local token behavior intact.

• Workflow gate (CI)

  • Updated .github/workflows/npm-publish.yml precheck to require either:
    • OIDC trusted publishing context, or
    • NPM_TOKEN fallback.
  • Clarifies workflow intent in header/comments.

• Release docs

  • Updated docs/RELEASE.md to reflect OIDC-first npm publishing and NPM_TOKEN as optional fallback.

if (hasGithubOidc) {
  const trustedEnv = { ...process.env };
  delete trustedEnv.NODE_AUTH_TOKEN;
  delete trustedEnv.NPM_TOKEN;

  result = publishWithPnpm(name, ['--access', 'public', '--no-git-checks', '--provenance'], trustedEnv);

  if ((result.status ?? 1) !== 0 && hasToken) {
    result = publishWithPnpm(name, ['--access', 'public', '--no-git-checks']);
  }
}