fix: add setup-node with registry-url for npm OIDC auth

The npm trusted publishing OIDC flow requires the registry URL
to be configured via actions/setup-node. This creates the .npmrc
that enables npm to perform OIDC token exchange during publish.

Per npm docs, no --provenance flag or NPM_TOKEN is needed when
trusted publishing is configured — npm handles auth automatically.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: dogmar

.github/workflows/release.yml

@@ -23,24 +23,14 @@ jobs:
           node-version: "22"
           cache: true
 
+      - uses: actions/setup-node@v4
+        with:
+          registry-url: "https://registry.npmjs.org"
+
       - run: vp install
 
       - run: vp run @klinking/squircle#build
 
-      - name: Debug npm auth context
-        run: |
-          echo "=== npm config ==="
-          npm config list
-          echo "=== OIDC env vars ==="
-          echo "ACTIONS_ID_TOKEN_REQUEST_URL set: ${{ env.ACTIONS_ID_TOKEN_REQUEST_URL != '' }}"
-          echo "ACTIONS_ID_TOKEN_REQUEST_TOKEN set: ${{ env.ACTIONS_ID_TOKEN_REQUEST_TOKEN != '' }}"
-          echo "=== .npmrc files ==="
-          cat ~/.npmrc 2>/dev/null || echo "no ~/.npmrc"
-          cat .npmrc 2>/dev/null || echo "no ./.npmrc"
-          cat package/.npmrc 2>/dev/null || echo "no package/.npmrc"
-
       - run: npx semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_CONFIG_PROVENANCE: true
-          DEBUG: "semantic-release:*,@semantic-release/npm:*"