fix(ci): publish opencode-plugin via OIDC, mirroring sdk-ts

[ojongerius]

The release workflow's npm auth diverged from the working release-sdk-ts.yml. sdk-ts publishes via OIDC trusted publishing with the canonical recipe — id-token: write + setup-node registry-url + npm publish --provenance, and no token at all. The original opencode workflow already matched that; it only 404'd because the package didn't exist and the trusted publisher wasn't configured yet — both now done.

My two intermediate "fixes" were wrong turns:

• fix(ci): publish opencode-plugin via npm OIDC trusted publishing #862 removed registry-url → ENEEDAUTH (npm had no registry context to attempt OIDC).
• the token-clear hack added an unneeded NODE_AUTH_TOKEN: "" and an npm install -g npm@latest step.

This PR

Makes the auth/publish config identical to release-sdk-ts.yml:

• Keep id-token: write + registry-url.
• Plain npm publish --access public --provenance --tag …, no NODE_AUTH_TOKEN, no npm upgrade step.
• No environment: (npm trusted-publisher config has none).

After merge I'll re-point opencode-plugin-v0.1.0-alpha.2 so the corrected workflow runs.