docs(readme): add npm authentication and publishing notes

Add Publishing Notes section explaining:
- npm trusted publishing via GitHub Actions OIDC
- Fallback NPM_TOKEN authentication
- Node.js and npm version requirements for trusted publishing

Add corresponding Chinese translation in README.zh-CN.md.

Co-Authored-By: Hagicode <noreply@hagicode.com>
Signed-off-by: newbe36524 <newbe36524@qq.com>

Author: newbe36524

README.md

@@ -104,3 +104,13 @@ npm run pack:check
 ```
 
 The published entry point is `bin/skillsbase.mjs`. In development, `npm run cli -- <args>` runs the TypeScript entry directly.
+
+## Publishing Notes
+
+The GitHub Actions workflow supports two npm authentication modes:
+
+- Preferred: npm trusted publishing via GitHub Actions OIDC
+- Fallback: `NPM_TOKEN` repository secret mapped to `NODE_AUTH_TOKEN`
+
+Before relying on trusted publishing, make sure the npm package settings for `@hagicode/skillsbase` trust the `HagiCode-org/skillsbase` repository.
+The npm docs currently require Node.js `>= 22.14.0` and npm `>= 11.5.1` for trusted publishing.

README.zh-CN.md

@@ -104,3 +104,13 @@ npm run pack:check
 ```
 
 发布入口为 `bin/skillsbase.mjs`。开发期可用 `npm run cli -- <args>` 直接运行 TypeScript 入口。
+
+## 发布说明
+
+GitHub Actions 发布流支持两种 npm 认证模式：
+
+- 推荐：GitHub Actions OIDC 的 npm trusted publishing
+- 兜底：仓库 `NPM_TOKEN` secret，经 `NODE_AUTH_TOKEN` 注入
+
+若使用 trusted publishing，需先在 npm 的 `@hagicode/skillsbase` 包设置中，将 `HagiCode-org/skillsbase` 配置为 trusted publisher。
+npm 官方当前要求 Node.js `>= 22.14.0` 且 npm `>= 11.5.1`。