sdg(phase-11): switch npm releases to trusted publishing (OIDC)

[lzrscg]

Release/devops work under specs/DEVOPS.md authority (Developer ruling 2026-07-28: tokenless OIDC is the desired end state; covered by the standing npm authorization — same artifact, same trigger, only the credential mechanism changes).

What changes

• .github/workflows/release.yml — publishing now authenticates via npm Trusted Publishing: the job upgrades npm to >= 11.5.1 (Node 22 bundles npm 10, which cannot do the OIDC exchange, with a hard version assert), and npm publish --provenance trades the workflow's GitHub Actions OIDC token for short-lived publish credentials. NODE_AUTH_TOKEN/registry-url wiring is gone. The NPM_TOKEN secret is now a bootstrap-only fallback: when present it is written as an env-substituted ~/.npmrc entry that npm reaches for only when the OIDC exchange is unavailable. Missing/broken credentials fail the publish step loudly with concrete setup instructions — a release is never silently skipped. Trigger (CI completion for a main push), green-CI gate, checkout of the exact CI-validated commit, strictly increasing versioning via next-version.mjs, and vX.Y.Z tagging are unchanged. Install and build still run on the stock CI-validated toolchain; the npm upgrade affects publishing only.
• specs/DEVOPS.md — records trusted publishing as the standing credential model (superseding the token-secret model recorded earlier the same day), the one-time bootstrap (preferred: local tokenless publish of 0.1.0, then configure the Trusted Publisher; alternative: CI publish with a temporary NPM_TOKEN), and the updated failure-handling rule.
• Also lands Liaison commit 7dcba9f (sdg(liaison): update PHILOSOPHY.md) from sdg/liaison-philosophy-oidc, which this branch is based on.

Verification

• Workflow YAML parses; every run: block passes bash -n.
• The npm-version assert accepts exactly >= 11.5.1 (rejects 11.5.0, accepts 11.5.1) and npm@^11.5.1 resolves on the registry (currently 11.18.0).
• The fallback ~/.npmrc line (\${NPM_TOKEN} env substitution) verified locally with the token env set.
• The OIDC exchange itself can only be proven once the Trusted Publisher is configured on npmjs.com; until then the Release run fails loudly with the setup instructions by design.

🤖 Generated with Claude Code