* ci(release): publish to npm via trusted publishing
Replace the NPM_TOKEN secret with GitHub OIDC token exchange, and add a
manually triggered job that verifies every package's trusted publisher
configuration without publishing anything.
npm only accepts an OIDC exchange from a cloud-hosted runner, so those two
jobs run on ubuntu-latest while the Go build matrix stays on self-hosted.
* fix(ci): harden npm trusted publishing checks
* fix(test): encode all slashes in release contract URLs
