chore(ci): migrate npm publish to trusted publishing (OIDC)

[just-shane]

npm's token crackdown killed the classic automation token this workflow used (`NPM_TOKEN`). This migrates auth to npm Trusted Publishing:

• No secret at all — the job mints a short-lived OIDC token (`id-token: write`) that npm matches against the trusted publisher configured on npmjs.com.
• Node 20 → 22, npm upgraded to ≥ 11.5.1 (trusted-publishing minimums).
• `--provenance` flag dropped — attestation is automatic on OIDC publishes from public repos.

Before the next release (one-time, needs the npm account):

1. npmjs.com → `@capitoltrace/congress-api` → Settings → Trusted Publisher → GitHub Actions → org `CapitolTrace`, repo `congress-api`, workflow `publish.yml`, allowed action `npm publish`.
2. Same Settings page → Publishing access → "Require two-factor authentication and disallow tokens" (trusted publishers are unaffected — this closes the token door completely).
3. Delete the now-unused `NPM_TOKEN` secret from this repo.

🤖 Generated with Claude Code