Consistently use the repository's preferred package manager - #2097

Switch the release workflow to npm trusted publishing:

- Add id-token: write so the job can mint a GitHub OIDC token.
- Drop the 'skip when NPM_TOKEN is empty' guard: the Version Packages PR
  and OIDC publishes need no secret. NPM_TOKEN stays wired through as a
  fallback only.
- Keep changesets/action with 'publish: pnpm release' unchanged. The
  publish path is OIDC-capable end to end: @changesets/cli v3 routes the
  actual publish through the detected package manager
  (changesets/changesets#2097), i.e. 'pnpm publish' per package, and
  pnpm 11 implements the npm OIDC token exchange natively, preferring it
  over any static _authToken (pnpm/pnpm#11495). So no restructuring to
  'pnpm -r publish' is needed and changesets keeps handling tags,
  GitHub releases, and skip-already-published logic.
- No npm CLI upgrade step: the npm >= 11.5.1 trusted-publishing minimum
  is met by node 24's bundled npm (11.17.0 today), and npm is not on the
  publish path anyway since pnpm performs the publish itself.
- No registry-url on setup-node: it would write an .npmrc token
  placeholder that shadows OIDC (npm/cli#8730).

Publishing succeeds once a trusted publisher (owner thilllon, repo
pixid, workflow release.yml) is configured on npmjs.com per package.
Trusted publishing cannot create a brand-new package, so the unscoped
'pixid' needs a one-time manual/token first publish before its trusted
publisher can be configured; until then the publish step fails on that
package only.

Co-authored-by: thilllon <[email protected]>