ci: drop setup-node registry-url so npm uses OIDC trusted publishing

[CodeSigils]

Problem

Tag-triggered publish (attempts #1: run 39019347080, #2: run 39020017166 on tag v1.5.2) fails at the publish job with:

npm error code E404
404 Not Found - PUT https://registry.npmjs.org/zero-md-formatter - Not found
The requested resource 'zero-md-formatter@1.5.2' could not be found or you do not have permission

Provenance succeeds (sigstore logIndex published), so OIDC id-token works; auth is the failure.

Root cause

actions/setup-node with registry-url writes into RUNNER_TEMP/.npmrc:

//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
registry=https://registry.npmjs.org/

NODE_AUTH_TOKEN is unset (trusted publishing), so that resolves to an empty token. npm prioritises this generated .npmrc, looks for a traditional _authToken, and skips the trusted-publisher OIDC handshake — the registry then answers 404. registry.npmjs.org is the default registry, so registry-url is unnecessary.

Fix

• Remove registry-url from the publish job's setup-node step.
• Add a diagnostic step printing the resolved registry, the (redacted) userconfig .npmrc, and whether the OIDC env vars are present.

References

• [BUG] OIDC publish failing from GitHub actions npm/cli#8730 — OIDC publish failing from GitHub Actions (.npmrc precedence skips OIDC even with empty token vars)
• Trusted publishing failures report misleading 404 / ENEEDAUTH errors instead of trusted-publishing diagnostics npm/cli#9088 — trusted-publishing failures mis-reported as 404/ENEEDAUTH
• docs.npmjs.com/trusted-publishers — OIDC auto-detected; no token needed

Repo created_at is 2026-05-20, so npm/cli#9969 (immutable OIDC subject claims for repos created after 2026-07-15) does not apply.