Harden npm trusted publishing workflow

[kody-bot]

Summary

• move npm OIDC/id-token permission out of dependency install/build jobs
• build package artifacts in an unprivileged job
• publish from the generated artifact with package-manager caching disabled
• set npm publish to ignore lifecycle scripts in the publish-authorized job
• pin release-path actions to commit SHAs

Context

Triggered by the TanStack npm supply-chain compromise postmortem: https://tanstack.com/blog/npm-supply-chain-compromise-postmortem

Testing

• workflow syntax checked by construction against the existing workflow shape