Migrate npm publishing to Trusted Publishing (OIDC)

[RodrigoHamuy]

Why

Releases on main fail at the publish step with E404 Not Found - PUT https://registry.npmjs.org/react-three-map (failing run). That 404 is npm's response to invalid auth — the NPM_TOKEN secret is no longer valid. Rather than rotating another expiring token, this migrates to npm Trusted Publishing (OIDC).

Changes

• Add id-token: write permission and remove the NPM_TOKEN env var — changesets/action@v1 automatically uses OIDC trusted publishing when no token is set.
• Upgrade npm to latest in the release job (trusted publishing requires npm >= 11.5.1).
• Bump .nvmrc from Node 20.11.1 to 22.17.1 — npm 11 requires Node ^20.17.0 || >=22.9.0, and Node 20 is past EOL.
• Bump actions/checkout and actions/setup-node to v4.

Manual steps before merging

1. On npmjs.com → react-three-map package → Settings → Publishing access, add a trusted publisher: GitHub Actions, repository RodrigoHamuy/react-three-map, workflow release.yml, environment blank.
2. After the first successful OIDC publish, delete the stale NPM_TOKEN repo secret.

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 66154e5

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

Latest deployment of this branch, based on commit 66154e5:

Sandbox	Source
example-mapbox	Configuration
example-maplibre	Configuration
stories	Configuration