Backport npm trusted publishing to 0.86

[cipolleschi]

Summary

• consolidate release, nightly, and bumped-package npm publishing into publish-npm.yml
• authenticate npm publishing through GitHub OIDC using the npm-publish environment
• use Node 24/npm 11.5+ and remove legacy GHA_NPM_TOKEN handling
• preserve the 0.86 Hermes V1 and Apple prebuild interfaces

This backports the trusted-publishing implementation from 0.87 without unrelated Hermes or release refactors.

Test plan

• yarn test scripts/releases-ci/__tests__/publish-npm-test.js --runInBand (11 tests passed)
• parsed all changed YAML files successfully
• verified exactly two npm publishing jobs have id-token: write and use the npm-publish environment
• verified no publishing action or workflow references GHA_NPM_TOKEN, gha-npm-token, or _authToken
• git diff --check origin/0.86-stable...HEAD

Note

The observed v0.86.1 failure occurs earlier in Sonatype staging-profile discovery and still requires restoring Sonatype access to the com.facebook namespace. Because the tag already contains the old workflow, rerunning that specific release also requires its legacy npm token to remain valid.

Changelog:

[INTERNAL] - Backport npm trusted publishing to the 0.86 release line.