chore(ci): switches npm publish to OIDC trusted publishing and align pnpm version

[hodanoori]

Summary

Replaces the classic NPM_TOKEN-based npm publish approach with OIDC Trusted Publishing, which uses short-lived job-scoped credentials instead of long-lived secrets. Also aligns the pnpm version to 10.32.1 across all workflows and package.json as part of the Renovate update.

Changes Made

• Added .github/workflows/publish-npm.yaml — publishes to npm on push to main using OIDC (id-token: write) with provenance attestation, no NPM_TOKEN secret required
• Added docs/npm-publish-handoff.md — step-by-step guide for the npm org admin to configure Trusted Publishers on npmjs.com
• Updated pnpm version to 10.32.1 in ci-checks.yaml, deploy-github-pages.yaml, and release.yaml
• Aligned packageManager field in package.json to pnpm@10.32.1

Related Docs

• npm sunsetting classic tokens
• npm Trusted Publishers docs

Related Issues:

• [EPIC](juno): trusted publishing for npm packages #1405

Screenshots (if applicable)

Testing Instructions

1. pnpm i
2. pnpm TASK

Checklist

• I have performed a self-review of my code.
• I have commented my code, particularly in hard-to-understand areas.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• I have made corresponding changes to the documentation (if applicable).
• My changes generate no new warnings or errors.
• I have created a changeset for my changes.

PR Manifesto

Review the PR Manifesto for best practises.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 8d62dad

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR