fix(ci): drop setup-node registry-url so pnpm uses OIDC

The v0.1.30 release 404'd on npm: actions/setup-node with registry-url writes an .npmrc with _authToken=${NODE_AUTH_TOKEN} and exports a dummy NODE_AUTH_TOKEN. pnpm sent that dummy as the bearer token instead of doing the OIDC exchange, so npm rejected the publish (masked as 404). Removing registry-url means no .npmrc and no dummy, so pnpm authenticates via OIDC against the default registry. pnpm stays on 10.x (10.33.0); pnpm 11 has an OIDC regression (pnpm#11513).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jascal

.github/workflows/release.yml

@@ -28,7 +28,9 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: '22'
-          registry-url: 'https://registry.npmjs.org'
+          # No registry-url on purpose: with it, setup-node writes an .npmrc and
+          # exports a dummy NODE_AUTH_TOKEN that pnpm sends as the bearer token
+          # instead of doing the OIDC exchange — npm masks that as a 404.
 
       - uses: pnpm/action-setup@v4
         with:
@@ -66,7 +68,9 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: '22'
-          registry-url: 'https://registry.npmjs.org'
+          # No registry-url on purpose: with it, setup-node writes an .npmrc and
+          # exports a dummy NODE_AUTH_TOKEN that pnpm sends as the bearer token
+          # instead of doing the OIDC exchange — npm masks that as a 404.
 
       - uses: pnpm/action-setup@v4
         with:
@@ -105,7 +109,9 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: '22'
-          registry-url: 'https://registry.npmjs.org'
+          # No registry-url on purpose: with it, setup-node writes an .npmrc and
+          # exports a dummy NODE_AUTH_TOKEN that pnpm sends as the bearer token
+          # instead of doing the OIDC exchange — npm masks that as a 404.
 
       - uses: pnpm/action-setup@v4
         with: