fix: npm trusted publishing

.github/workflows/publish.yml

@@ -5,23 +5,20 @@ on:
     tags:
     - 'v*'
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   npm:
     name: Publish to NPM
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-node@v4
+    - uses: actions/checkout@v6
+    - uses: actions/setup-node@v6
       with:
-        node-version: 20
-        registry-url: https://registry.npmjs.org/
-    - uses: pnpm/action-setup@v4
-      with:
-        run_install: false
-    - run: pnpm install --frozen-lockfile
-    - run: pnpm publish --no-git-checks
-      env:
-        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        NPM_CONFIG_PROVENANCE: true
+        node-version: "24"
+        registry-url: "https://registry.npmjs.org"
+    - run: npm install -g npm@latest
+    - run: npm ci
+    - run: npm publish