fix publish: use trusted publisher pattern from cli repo (no NPM_TOKEN)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/publish.yml

@@ -60,16 +60,16 @@ jobs:
     name: Publish to npm
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: actions/setup-node@v6
         with:
-          bun-version: latest
-
-      - name: Install dependencies
-        working-directory: napi
-        run: bun install
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Download all artifacts
         uses: actions/download-artifact@v4
@@ -85,4 +85,4 @@ jobs:
           echo "=== Package contents ==="
           ls -la *.node index.js index.d.ts
 
-          npm publish --access public --provenance
+          npm publish --provenance --access public