fix(ci): restore OIDC for CLI publishing

[Aymericr]

The CLI publish step fell back to the repository npm token after trusted publishing was introduced. The current token now requires an OTP, so @pascal-app/cli@1.0.0-beta.2 could not publish.

This restores the intended tokenless OIDC path for the CLI. npm still needs the package trusted-publisher mapping for pascalorg/editor, .github/workflows/release.yml, and the npm environment before the release can succeed.

Validation: git diff --check.

---

Note

Low Risk
CI-only change to CLI publish authentication; no application runtime impact, though releases depend on npm trusted-publisher configuration being correct.

Overview
The Publish CLI step in release.yml no longer sets NODE_AUTH_TOKEN from secrets.NPM_TOKEN, so npm publish can use GitHub OIDC trusted publishing (the job already requests id-token: write and runs in the npm environment).

A comment documents that token auth must stay unset for that exchange. Other packages in the workflow still publish with the legacy npm token; only the CLI path is aligned with the intended tokenless flow that was broken when the step inherited token auth.

^{Reviewed by Cursor Bugbot for commit 58f668b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[pascal]

I hit an error while handling your request (Model unavailable on AI Gateway free tier: Free tier users do not have access to this model. Upgrade to paid credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up for unrestricted…).

Please try again, rephrase, or reach out if it keeps failing.

Error id: 190b58a6-1cbb-4bc2-9ecd-61df79e3b4ec