Harden npm trusted publishing workflow

[kody-bot]

Summary

• keep npm OIDC/id-token permission out of install/build/test jobs where possible
• run package build/test work before entering the publish-authorized job
• disable package-manager caching in publish jobs
• install publish-time tooling with lifecycle scripts disabled when the custom release command requires local tooling
• pin release-path actions to commit SHAs

Context

Triggered by the TanStack npm supply-chain compromise postmortem: https://tanstack.com/blog/npm-supply-chain-compromise-postmortem

Testing

• workflow syntax checked by construction against the existing workflow shape