[MyPrototypeWhat]

This moves releases from the NPM_TOKEN secret to npm trusted publishing (OIDC), and ships the change as 0.3.2. npm is removing direct publish from tokens that bypass 2FA, with January 2027 as the target. Our CI token is that kind of token.

Change

• release.yml
  • The job gets id-token: write.
  • It installs npm 11, because trusted publishing needs npm ≥ 11.5.1 and Node 22 ships npm 10.
  • It drops registry-url and NODE_AUTH_TOKEN, so npm publish exchanges the job's OIDC token and signs a provenance statement.
  • Node stays at 22, matching CI, so the "lib/ is fresh" check behaves exactly as before.
• 0.3.2 (package.json, PLUGIN_VERSION, CHANGELOG, rebuilt lib/). There are no code changes. npm expires a new trusted-publisher configuration that is not used within 2 days, so this release is what activates it.

Rollout, in this order

1. Merge this PR.
2. Register the trusted publisher. This needs a logged-in npm session with 2FA:

   npm trust github @refkit/dsh-plugin --repo refkitjs/dsh-plugin --file release.yml --allow-publish --yes

3. Within 2 days, push the v0.3.2 tag. The Release workflow then publishes through OIDC.
4. Once npm shows 0.3.2 with provenance, delete the NPM_TOKEN repository secret and revoke that token on npmjs.com.

Testing

Gate: install, typecheck, lint, 174 tests, build, the client bundle check and the host smoke all pass. lib/ changes only in the version string. The OIDC publish itself can only be proven by the 0.3.2 release.