[EPIC](juno): trusted publishing for npm packages

[ArtieReus]

Description

Switch npm release to trusted publishing for npm packages.

Additional Notes

• https://github.blog/changelog/2025-09-29-strengthening-npm-security-important-changes-to-authentication-and-token-management/
• https://docs.npmjs.com/trusted-publishers

[hodanoori]

Investigated and implemented the switch to npm Trusted Publishing (OIDC) to move away from classic tokens, which npm is sunsetting.

The GitHub Actions workflow has been set up — no stored tokens needed anymore. The remaining step (configuring Trusted Publishers on npmjs.com) requires access to the npm org and ownership of the packages.

Handing over to @andypf who already has the necessary npm org access and has published our packages before. The exact steps are documented in docs/npm-publish-handoff.md.

PR: #1581