[DND-1562] Publish @opik/ccsync via trusted publishing (OIDC) instead of NPM_TOKEN

[obezpalko]

Details

publish.yml authenticated npm publish with secrets.NPM_TOKEN. That path is gone:

• npm disabled classic-token creation on 2025-11-05 and revoked every classic token on 2025-12-09;
• granular write tokens are capped at a 90-day lifetime, so a stored secret means quarterly rotation or a broken release.

This switches @opik/ccsync to npm trusted publishing — a short-lived OIDC token minted per workflow run, nothing stored:

• id-token: write on the publish job (plus contents: write, which the existing tag-push step already needed but never declared). npm matches this workflow's filename, publish.yml, against the trusted publisher configured on npmjs.com.
• Node 18 → 22.14.0 and npm → 11.6.2 — trusted publishing requires Node ≥ 22.14.0 / npm ≥ 11.5.1, and Node 22.14.0 still ships npm 10.
• NODE_AUTH_TOKEN removed. Before publishing we delete the //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN} stub that setup-node writes into ~/.npmrc; with no token set npm would otherwise try that empty credential instead of falling back to the OIDC exchange.
• package.json gains a repository field. Provenance attestations are generated automatically for trusted publishes from GitHub Actions on public repos, and provenance requires a repository URL matching the publishing repo — without it the publish would fail.
• actions/checkout and actions/setup-node bumped off their deprecated v3 runtimes.

Required before the next release: configure the trusted publisher for @opik/ccsync on npmjs.com (package Settings → Trusted Publisher → org comet-ml, repo ccsync, workflow filename publish.yml, filename only and case-sensitive). Then enable "disallow token-based publishing" for the package and delete the NPM_TOKEN repo secret. @opik/ccsync@0.1.0 already exists on the registry, so a publisher can be attached to it now.

Tracked in DND-1562, alongside the same migration for the opik packages (comet-ml/opik#7918).

Testing

• yaml.safe_load on the workflow and json.loads on package.json — both parse.
• The publish path itself only runs on workflow_dispatch, and it cannot be dry-run pre-merge: OIDC needs the trusted publisher registered on npmjs.com first. It fails closed — if OIDC is not configured, npm publish returns an auth error rather than silently falling back to a token.
• Reference: comet-ml/opik-mcp (legacy-ts-deploy.yml) and comet-ml/opik-openclaw (release.yml) already publish this way in production.

AI-WATERMARK: yes — Claude Code / Claude Opus 5; scope: the workflow and package.json edits plus this description. Verified against npm's trusted-publishing docs and the npm classic-token revocation changelog.