ci: replace @semantic-release/npm with exec for OIDC publishing

Remove @semantic-release/npm entirely since it always runs npm whoami
which is incompatible with OIDC. Use @semantic-release/exec for both
version bumping (prepareCmd) and publishing (publishCmd via npm publish
--provenance which handles OIDC natively).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: manuelbieh

release.config.js

@@ -53,8 +53,13 @@ module.exports = {
             },
         ],
         '@semantic-release/changelog',
-        ['@semantic-release/npm', { npmPublish: false }],
-        ['@semantic-release/exec', { publishCmd: 'npm publish --provenance --access public' }],
+        [
+            '@semantic-release/exec',
+            {
+                prepareCmd: 'npm version ${nextRelease.version} --no-git-tag-version',
+                publishCmd: 'npm publish --provenance --access public',
+            },
+        ],
         '@semantic-release/github',
         [
             '@semantic-release/git',