chore: prepare npm OIDC trusted publishing

[omegent-app]

Summary

• Prepare npm Trusted Publishing (OIDC) so releases no longer depend on a long-lived NPM_TOKEN (the root cause of the 4.0.0-beta.299 E404 publish failure).
• Add repository metadata on all publishable packages (required for OIDC/provenance matching).
• Ship the intended Changesets workflow as .github/release.oidc.yaml (copy → .github/workflows/release.yaml) because the bot cannot push workflow file updates.
• Document exact npmjs.com steps in .github/npm-trusted-publishing.md.

What the workflow change does (once applied)

• permissions.id-token: write
• Ensure npm CLI ≥ 11.5.1
• Remove NPM_TOKEN from the publish step (changesets/action uses OIDC when token is absent)

Exact steps on npm (do this before applying the workflow)

For each package below, open Settings → Trusted Publisher → GitHub Actions:

Package	URL
effect-app	https://www.npmjs.com/package/effect-app/access
@effect-app/infra	https://www.npmjs.com/package/@effect-app/infra/access
@effect-app/vue	https://www.npmjs.com/package/@effect-app/vue/access
@effect-app/vue-components	https://www.npmjs.com/package/@effect-app/vue-components/access
@effect-app/cli	https://www.npmjs.com/package/@effect-app/cli/access
@effect-app/eslint-codegen-model	https://www.npmjs.com/package/@effect-app/eslint-codegen-model/access
@effect-app/eslint-shared-config	https://www.npmjs.com/package/@effect-app/eslint-shared-config/access

Fill exactly:

• Organization or user: effect-app
• Repository: libs
• Workflow filename: release.yaml (filename only, .yaml not .yml)
• Environment name: (leave empty)
• Allowed actions: npm publish

Save. npm does not validate on save — mismatches only appear at publish time.

Apply workflow after merge (maintainer, needs workflows permission)

git checkout main && git pull
cp .github/release.oidc.yaml .github/workflows/release.yaml
git add .github/workflows/release.yaml
git commit -m "ci: enable npm OIDC trusted publishing in Changesets workflow"
git push

That push should publish any unpublished versions (e.g. 4.0.0-beta.299).

Success log line:

No NPM_TOKEN found, but OIDC is available - using npm trusted publishing

After first successful OIDC publish (optional harden)

1. Each package → Publishing access → Require 2FA and disallow tokens
2. Delete GitHub secret NPM_TOKEN and revoke old npm automation tokens

Full checklist: .github/npm-trusted-publishing.md

Test plan

• Trusted publishers configured on all 7 packages
• Merge this PR
• Maintainer applies release.oidc.yaml → workflows/release.yaml and pushes
• Changesets job succeeds; packages appear on npm (e.g. effect-app@4.0.0-beta.299)
• Log shows OIDC trusted publishing path (not NPM_TOKEN auth)

[pkg-pr-new]

Open in StackBlitz

@effect-app/cli

npm i https://pkg.pr.new/effect-app/libs/@effect-app/cli@824

effect-app

npm i https://pkg.pr.new/effect-app/libs/effect-app@824

@effect-app/eslint-codegen-model

npm i https://pkg.pr.new/effect-app/libs/@effect-app/eslint-codegen-model@824

@effect-app/eslint-shared-config

npm i https://pkg.pr.new/effect-app/libs/@effect-app/eslint-shared-config@824

@effect-app/infra

npm i https://pkg.pr.new/effect-app/libs/@effect-app/infra@824

@effect-app/vue

npm i https://pkg.pr.new/effect-app/libs/@effect-app/vue@824

@effect-app/vue-components

npm i https://pkg.pr.new/effect-app/libs/@effect-app/vue-components@824

commit: 4e170bb