Add auto-detection and opt-in support for npm's OIDC trusted publishing
(https://docs.npmjs.com/trusted-publishers), eliminating the need for
long-lived NPM_TOKEN secrets.

- Auto-detect OIDC from CI env vars (GitHub Actions ACTIONS_ID_TOKEN_*
  and GitLab NPM_ID_TOKEN) when NPM_TOKEN is absent
- Add explicit `oidc: true` config option to force OIDC mode
- Skip temp .npmrc injection in OIDC mode so npm's native OIDC detection
  is not overridden
- Validate npm >= 11.5.1 when OIDC is in use; hard-error on explicit
  `oidc: true` with incompatible environments, warn and fall through to
  token error on auto-detected OIDC with old npm
- getLatestVersion() runs without auth when no token is available (works
  for public packages; warns and skips check for private packages)
- Token auth and all existing behavior unchanged when NPM_TOKEN is set

- Extract duplicated isNewEnough version check to isNpmVersionSufficientForOidc() helper
- Propagate oidc config option to expanded workspace targets in expand()
- Fix test assertion that was checking NPM_BIN ('npm') instead of 'NPM_TOKEN'
- Add test coverage for oidc propagation through workspace expand()

Replace the ad-hoc NPM_OIDC_MIN_{MAJOR,MINOR,PATCH} constants and the
isNpmVersionSufficientForOidc() helper with the existing SemVer utilities
already imported in npm.ts:

- Single NPM_OIDC_MIN_VERSION: SemVer constant instead of three separate ones
- versionGreaterOrEqualThan(npmVersion, NPM_OIDC_MIN_VERSION) replaces the
  custom comparison logic
- this.npmVersion now stores the full SemVer from parseVersion() directly
- TestNpmTarget.mockVersion typed as SemVer to match