Use npm trusted publishing

[birkskyum]

Summary

• remove the long-lived NPM_TOKEN from the release workflow
• let npm authenticate through GitHub Actions OIDC

Context

This matches the release setup in solidjs/solid-image. The workflow already has id-token: write, uses a GitHub-hosted runner, sets up Node 24, and targets the npm registry.

The package must exist on npm before its trusted publisher can be configured. After the initial publish, configure the npm package with:

• Organization: solidjs
• Repository: start-devtools
• Workflow: release.yml
• Allowed action: npm publish

Testing

• Prettier check
• git diff --check