OIDC Publishing

Owner-triggered npm publishing uses Trusted Publishing/OIDC and does not use long-lived npm registry tokens.