fix(ci): publish via OIDC trusted publishing, not a non-existent NPM_TOKEN (#1836)

* fix(ci): publish via OIDC trusted publishing, not a non-existent NPM_TOKEN

The 2.0.0-rc.1 publish failed with `npm error code ENEEDAUTH`. Two causes, both
in the v2 publish job, which had never actually executed before — every prior
release was cut from the v1 workflow.

1. `NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` pointed at a secret that does
   not exist (the repo has no secrets at repo or environment level — publishing
   moved to OIDC trusted publishing). `setup-node` therefore wrote an *empty*
   `_authToken` into its generated `.npmrc`, and npm failed ENEEDAUTH before
   OIDC was ever attempted. Removed, with a comment saying why it must not be
   "restored".

2. The job never upgraded the npm CLI. Trusted publishing requires npm
   >= 11.5.1 and Node 22 bundles 10.x, so this would have failed even with the
   token line gone. The v1 workflow has this step; v2 was missing it.

The RC did its job: it caught both against the real registry, and consumed
nothing — the run failed before `npm publish` wrote anything, so no version was
burned and the dist-tags are untouched.

Also confirms #1834 works: the log shows `Publishing 2.0.0-rc.1 under dist-tag
'next'` before the auth failure.

README corrected — it documented `NPM_TOKEN` as part of the publish setup.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD

* docs: restructure the test-servers section into navigable subsections

The section had grown into eight undifferentiated paragraphs, the longest 1,965
characters, each describing one or two showcase configs. The content is good
reference material — the problem was purely that you could not find anything in
it or tell where one config's description ended and the next began.

Restructured, not rewritten. No facts removed:

- A summary table of all nine showcase configs, with what each demonstrates and
  its tracking issue, so the set is visible at a glance.
- One `####` subsection per config family, so each is linkable and skimmable.
- Enumerations that were buried in prose are now tables: the six MRTR presets,
  the four `trigger_*` spec-error tools and their status/code pairs.
- Step sequences (advertised extensions) and era contrasts (logging,
  subscriptions, tasks) are now bullets rather than run-on sentences.
- Two caveats that were parenthetical asides — browser `Mcp-Param-*` skipping,
  and `collect_elicitation` erroring on the modern leg — are now blockquotes,
  since both are things you hit and then have to go hunting for.

Longest line drops 1,965 → 620 characters. Verified every previously-documented
config and all technical identifiers survive.

Noted while auditing: `demo.json`, `oauth-step-up-demo.json`,
`url-elicitation-form.json` and `xaa-ema-http.json` exist in
`test-servers/configs/` but have never been documented here. Left alone —
that is a pre-existing gap, not a regression from this change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/main.yml

@@ -154,6 +154,11 @@ jobs:
             exit 1
           fi
 
+      # OIDC trusted publishing requires npm >= 11.5.1; Node 22's bundled npm is
+      # 10.x, which fails with ENEEDAUTH before OIDC is ever attempted.
+      - name: Ensure npm CLI supports OIDC trusted publishing
+        run: npm install -g npm@^11.5.1
+
       - name: Install dependencies (root + all clients)
         run: npm install
 
@@ -178,6 +183,13 @@ jobs:
         # (`2.0.0-rc.1`); build metadata uses `+` and is not a prerelease. Done
         # in shell rather than with `semver` because that package is only a
         # transitive dependency here and must not be relied on in CI.
+        #
+        # There is deliberately NO `NODE_AUTH_TOKEN` here. Publishing uses npm
+        # OIDC trusted publishing (`id-token: write` + `environment: release`),
+        # which needs no token — and the repo has no `NPM_TOKEN` secret. Setting
+        # it from a non-existent secret writes an EMPTY `_authToken` into the
+        # `.npmrc` that `setup-node` generates, and npm then fails `ENEEDAUTH`
+        # before OIDC is ever attempted. Do not "restore" it.
         run: |
           VERSION="$(node -p "require('./package.json').version")"
           case "$VERSION" in
@@ -186,8 +198,6 @@ jobs:
           esac
           echo "Publishing $VERSION under dist-tag '$NPM_TAG'"
           npm publish --access public --provenance --tag "$NPM_TAG"
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   # Build and push the multi-arch container image to GHCR on a published
   # release. The image installs the packed tarball (`Dockerfile`) so it ships