Use OIDC trusted publishing for platform packages

Switch from manual ~/.npmrc token handling to OIDC with --provenance
flag, matching how the main package is published. This uses npm's
recommended approach for trusted publishing from GitHub Actions.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: brianlovin

.github/workflows/publish.yml

@@ -36,16 +36,15 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
 
       # Publish platform packages first (they must exist before main package)
+      # Using OIDC trusted publishing (same as main package)
       - name: Publish platform packages
         env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
-          # Write .npmrc with auth token (setup-node's .npmrc doesn't work for subdirectory publishing)
-          echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
           for dir in dist/binaries/*/; do
             name=$(basename "$dir")
             echo "Publishing $name..."
-            (cd "$dir" && npm publish --access public) || echo "Package may already exist, continuing..."
+            (cd "$dir" && npm publish --provenance --access public) || echo "Package may already exist, continuing..."
           done
 
       # Remove binaries from dist before publishing main package (they're in separate packages)