ci: switch NuGet and npm publishing to Trusted Publishing (OIDC)

[Aragas]

Switches NuGet and npm publishing from long-lived secrets to Trusted Publishing (GitHub OIDC).

• publish.yml (NuGet): short-lived API key via NuGet/login@v1 instead of NUGET_API_KEY
• publish-native-ts.yml / publish-wasm.yml (npm): tokenless npm publish via OIDC instead of PUBLISH_NPM_TOKEN; the publish step now uses Node 22 + latest npm (trusted publishing requires npm >= 11.5.1). The GPR publish now uses the built-in GITHUB_TOKEN instead of PUBLISH_GITHUB_TOKEN. Note: the wasm publish job remains disabled (if: false), unchanged.

Before merging

• On nuget.org (account Aragas) add a Trusted Publishing policy: Repository Owner BUTR, Repository FetchBannerlordVersion, Workflow File publish.yml
• On npmjs.com, for each published package (e.g. @butr/fetchbannerlordversion), Settings -> Trusted publisher: GitHub Actions, org BUTR, repo FetchBannerlordVersion, workflow publish-native-ts.yml (and publish-wasm.yml for the wasm package if re-enabled)
• Merge within 7 days of creating the nuget.org policy (it must see a successful publish to become permanently active)

After a successful publish

• Remove the NUGET_API_KEY, PUBLISH_NPM_TOKEN and PUBLISH_GITHUB_TOKEN secrets from this repo

🤖 Generated with Claude Code