ci: publish to npm from CI with OIDC trusted publishing (#5028)