fix(release): Support npm trusted publishing

[iamfj]

Summary

• Upgrade semantic-release to v25 so the npm release plugin supports OIDC trusted publishing.
• Update bun.lock so releases resolve @semantic-release/npm@13.1.5 instead of the token-only v12 path.
• Fixes the release failure where semantic-release reported ENONPMTOKEN after removing NPM_TOKEN.

Validation

• bun run check
• bun run test
• bun run pack:dry-run

Security checklist

• The change doesn't add install-time scripts or unexpected network access.
• The change doesn't log secrets, tokens, environment values, or raw local state.
• The change keeps filesystem writes scoped to documented paths.
• GitHub Actions permissions remain least-privilege.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
pi-stack-ops	Ready	Preview, Comment	Jun 15, 2026 6:32pm

[github-actions]

🎉 This PR is included in version 1.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀