ci(release): 修复 OIDC 发布认证链路

移除 setup-node 的 registry-url 注入，避免发布步骤继承无效 NODE_AUTH_TOKEN。

发布前升级 npm 到 v11，使用独立 npmrc 并启用 provenance，以匹配 npm trusted publishing。

.github/workflows/release.yml

@@ -160,7 +160,6 @@ jobs:
         with:
           node-version: '22'
           cache: pnpm
-          registry-url: 'https://registry.npmjs.org'
 
       - name: Install Dependencies
         run: pnpm install --frozen-lockfile
@@ -239,7 +238,15 @@ jobs:
       - name: Publish to npm (trusted publishing)
         id: publish_npm
         if: steps.changesets.outputs.hasChangesets == 'false' && steps.publish_check.outputs.needs_publish == 'true'
-        run: pnpm ci:publish
+        env:
+          NODE_AUTH_TOKEN: ""
+          NPM_CONFIG_USERCONFIG: /home/runner/work/_temp/trusted-npmrc
+          NPM_CONFIG_PROVENANCE: "true"
+        run: |
+          npm install -g npm@^11
+          npm --version
+          printf "registry=https://registry.npmjs.org/\n" > "$NPM_CONFIG_USERCONFIG"
+          pnpm ci:publish
 
       - name: Set release outputs
         id: publish_metadata