Enable npm trusted publishing on 0.85

[cipolleschi]

Summary

• consolidate release, nightly, and bumped-package publication in publish-npm.yml with npm OIDC trusted publishing
• validate canonical repository metadata for every public package before Maven or npm publication
• add the missing popup-menu repository metadata and canonicalize the two SSH repository entries
• use the canonical GitHub API owner for release-asset uploads
• run post-publish, changelog, Podfile.lock, and draft-release jobs after a successful release publish
• backport Nicola Corti's Sonatype staging profile fix

This is stacked on #57711 and should be retargeted to 0.85-stable after that PR merges. No post-release recovery/resume path is included.

Changelog:

[Internal] - Migrate to trusted publishing.

Test plan

• node scripts/releases-ci/validate-npm-package-metadata.js (24 packages)
• focused publisher, validator, and release-asset uploader Jest suites
• targeted ESLint and Prettier checks
• YAML parse and trusted-publishing/post-release job-graph assertions
• runtime syntax checks and git diff --check

Flow could not start locally because the installed Flow binary does not support experimental.pattern_matching and casting_syntax from this branch's .flowconfig.

[github-actions]

Caution

Invalid Base Branch

The base branch for this PR is backport/0.85-repository-migration, which is not main or a -stable branch.
Are you sure you want to target this branch?