chore: use OIDC to publish to npm (#5681)

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: mark-wiemer <7833360+mark-wiemer@users.noreply.github.com>

Author: Copilot

.github/workflows/release-please.yml

@@ -7,6 +7,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   release_please:
@@ -30,8 +31,6 @@ jobs:
     environment: npm
     needs: release_please
     if: needs.release_please.outputs.releaseCreated
-    permissions:
-      id-token: write
     steps:
       - uses: actions/checkout@v6
         with:
@@ -41,6 +40,9 @@ jobs:
           node-version: "22"
           registry-url: "https://registry.npmjs.org"
 
+      - name: Upgrade npm for OIDC support
+        run: npm install -g npm@latest
+
       - name: Install dependencies
         run: npm ci --ignore-scripts --force --no-fund --no-audit