Use npm trusted publishing

[naaiyy]

What changed

• Publish all viewer packages through npm OpenID Connect authentication.
• Remove the npm publish token and explicit provenance settings.
• Pin a compatible npm CLI for the release job.
• Add a safe manual retry path for an existing immutable viewer release tag.
• Make tag pushes and manual retries use the same concurrency lock.
• Document token-free publishing and release retries.

Why

The alpha.14 release failed because the workflow expected an npm token. All nine packages now authorize the BaseBlocks-HQ/anydoc publish-viewers.yml workflow as their trusted publisher.

Validation

• Viewer release metadata check
• Prettier check
• Workflow YAML structure check
• Release-tag validation tests
• Standards adversarial review: no findings
• Specification adversarial review: no findings