- Remove NPM_TOKEN / NODE_AUTH_TOKEN — publish now uses OIDC trusted
publishing (no secrets needed)
- Add workflow_dispatch trigger with prerelease checkbox: publishes to
alpha dist-tag so we can verify OIDC works without touching latest
- Drop --provenance flag (included automatically with trusted publishing)
The release event path still publishes to latest as before; the only
change is the auth mechanism.
To test: bump version to x.y.z-alpha.0 on a branch, then run workflow
with prerelease checked.
4f91d7f324