misc: set up npm trusted publishing

[lusayaa]

set up npm Trusted Publishing (OIDC) for the repository.

previous nightly publish.yml -> publish_nightly.yml
publish.ymlwill now run when a tag is pushed or with a manual trigger. this will still require manual tag push as part of the release process, it's just replacing the npm publish step.

also had to run npm pkg fix because it was complaining about the binary paths.

fyi, generated with help of paul's npm-trusted-publishing skill

[connorjclark]

what's the goal here? this job is a cron for nightly publishing but we disabled it awhile ago. for actual releases we don't use GHA

[lusayaa]

goal is to follow https://docs.npmjs.com/trusted-publishers. i think Paul already linked the GitHub publish.yml in npm to this repo. so it's a matter of linking it up on the GitHub side of things.

[paulirish]

yeah, let's actually rename this file to publish-nightly.yml

And then we'll want to create a brand new file for publish. That is a combination of this file and whatever my skill thinks we should do.

[paulirish]

oh i see you introduced a new release.yml.

yahhhhh if you're okay with it.. renaming this old file to publish-nightly and keeping the new one as publish.yml is slightly better.

[lusayaa]

yea that's fine. renaming it. including build-all bc it was in manual instructions...overkill?

[paulirish]

no in fact that's probably required for this to work. probably? dunno.

[lusayaa]

alright, I think I figured out the config now..hopefully. did a dry run, results here