ci(release): publish to npm via trusted publishing, idempotent loop (#105)

* ci(release): publish to npm via trusted publishing (OIDC)

The publish job failed with npm E404 because it published unauthenticated
(no NODE_AUTH_TOKEN; setup-node's placeholder token). Switch to npm Trusted
Publishing instead of a long-lived token:

- upgrade npm to >= 11.5.1 (OIDC support) after setup-node
- drop NODE_AUTH_TOKEN and the --provenance flag; with the GitHub Actions
  OIDC environment (id-token: write) npm authenticates via the per-package
  Trusted Publisher on npmjs.com and generates provenance automatically

Requires a Trusted Publisher configured on npmjs.com for each @pleaseai/code*
package (repo pleaseai/code-intelligence, workflow file release-please.yml).

* ci(release): make npm publish idempotent (skip already-published versions)

A partial publish left @pleaseai/code-darwin-arm64@0.1.14 on npm while the
other 7 packages stayed at 0.1.13. Re-running aborted on the first package
with 'cannot publish over previous version', never reaching the missing ones.
Check npm view per package and publish only versions not yet present.

Author: amondnet

.github/workflows/release-please.yml

@@ -79,9 +79,29 @@ jobs:
       - name: Build npm packages
         run: bun run build:npm
 
+      # Trusted publishing (OIDC) needs npm >= 11.5.1; setup-node's bundled npm may be older.
+      - name: Upgrade npm for trusted publishing
+        run: npm install -g npm@latest
+
+      # No NODE_AUTH_TOKEN: npm detects the GitHub Actions OIDC environment (id-token: write)
+      # and authenticates via the per-package Trusted Publisher configured on npmjs.com.
+      # Provenance is generated automatically for trusted publishing.
+      # Idempotent: skip versions already on npm so a re-run (e.g. after a
+      # partial publish) only pushes the packages still missing, instead of
+      # aborting on the first "cannot publish over previous version".
       - name: Publish to npm
         run: |
-          for dir in npm/code-*; do
-            (cd "$dir" && npm publish --provenance --access public)
-          done
-          cd npm/code && npm publish --provenance --access public
+          set -euo pipefail
+          publish_if_new() {
+            local dir="$1" name ver
+            name=$(cd "$dir" && node -p "require('./package.json').name")
+            ver=$(cd "$dir" && node -p "require('./package.json').version")
+            if npm view "$name@$ver" version >/dev/null 2>&1; then
+              echo "== skip $name@$ver (already published)"
+            else
+              echo "== publish $name@$ver"
+              (cd "$dir" && npm publish --access public)
+            fi
+          }
+          for dir in npm/code-*; do publish_if_new "$dir"; done
+          publish_if_new npm/code