Publish to npm with trusted publishing

Switches the release workflow from the NPM_VERCEL_TOKEN_ELEVATED token to npm trusted publishing (OIDC), matching vercel-labs/json-render.

• The publish job runs in the Release environment with id-token: write and publishes with --provenance.
• Node 24 from a new .node-version file (npm 11.5.1+ is needed for trusted publishing).
• Each public package under packages/@visual-json is packed with pnpm and published with npm. Versions already on npm are skipped, so a rerun picks up where a failed one stopped.
• The GitHub release is created even when npm is already current but the tag is missing.
• Workflow permissions default to contents: read. Only the release job gets contents: write.

Trusted publishers for @visual-json/core, react, vue, svelte and yaml are configured on npm (vercel-labs/visual-json, release.yml, environment Release).