ci: publish via npm trusted publishing (OIDC) (#770)

## Summary

Switch npm releases from the long-lived `NPM_TOKEN_ELEVATED` secret to
[npm trusted publishing](https://docs.npmjs.com/trusted-publishers/)
(GitHub Actions OIDC), following
[vercel/nft#585](vercel/nft#585).

## Changes (`.github/workflows/ci.yml`)

- Drop `NPM_TOKEN` and `NPM_CONFIG_PROVENANCE` — OIDC handles auth and
provenance attestations are automatic under trusted publishing.
- Run the release on **Node 22** (trusted publishing requires Node ≥
22.14). The release matrix entry moves `20 → 22`.
- **Upgrade npm before releasing** (`npm install -g npm@latest`):
`actions/setup-node` ships npm 10.x, but OIDC trusted publishing needs
npm ≥ 11.5.1, or it silently falls back / 404s on publish. This is the
step the nft PR omitted.
- Update the `id-token: write` comment.

`package.json` already has the object-form `repository.url` that npm
uses to verify the repo during OIDC, so no change there (nft had to add
this).

## Prerequisites (before merge / first release)

Configure a trusted publisher on npm for `satori`:

1. Package settings → Trusted publishing
2. Provider: **GitHub Actions**
3. Repository: `vercel/satori`
4. Workflow filename: `ci.yml`

After the first successful OIDC publish, consider restricting publishing
access to disallow tokens.

## Note

The test matrix changes from `[18, 20]` to `[18, 22]` (Node 20 test
coverage replaced by 22). Happy to run `[18, 20, 22]` instead if we want
to keep 20.

## Test plan

- [ ] Trusted publisher configured on npmjs.com for workflow `ci.yml`
- [ ] Merge to `main` and confirm semantic-release publishes without
`NPM_TOKEN`
- [ ] Verify published package includes provenance attestations

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: dnukumamras

.github/workflows/ci.yml

@@ -42,13 +42,13 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]
-        node: [18, 20]
+        node: [18, 22]
     runs-on: ${{ matrix.os }}
     permissions:
       contents: write # to be able to publish a GitHub release
       issues: write # to be able to comment on released issues
       pull-requests: write # to be able to comment on released pull requests
-      id-token: write # to enable use of OIDC for npm provenance
+      id-token: write # required for npm trusted publishing (OIDC)
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -64,10 +64,12 @@ jobs:
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
       - run: pnpm test
+      - name: Update npm for trusted publishing
+        # actions/setup-node ships npm 10.x; OIDC trusted publishing needs >= 11.5.1
+        if: matrix.os == 'ubuntu-latest' && matrix.node == 22 && github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: npm install -g npm@latest
       - name: Maybe Release
-        if: matrix.os == 'ubuntu-latest' && matrix.node == 20 && github.event_name == 'push' && github.ref == 'refs/heads/main'
+        if: matrix.os == 'ubuntu-latest' && matrix.node == 22 && github.event_name == 'push' && github.ref == 'refs/heads/main'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN_ELEVATED }}
-          NPM_CONFIG_PROVENANCE: 'true'
-        run: pnpm dlx semantic-release@24.2.3
+        run: pnpm dlx semantic-release@25.0.5