fix: настроить OIDC-публикацию npm

- release job переведён на checkout и setup-node v6
- npm registry настроен явно без кеширования release job
- пакет публикуется из корня через стандартный npm publish

.github/workflows/release.yml

@@ -4,13 +4,19 @@ on:
   release:
     types:
       - published
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing release tag to publish
+        required: true
+        type: string
 
 permissions:
   contents: write
   id-token: write
 
 concurrency:
-  group: release-${{ github.event.release.tag_name }}
+  group: release-${{ github.event.release.tag_name || inputs.tag }}
   cancel-in-progress: false
 
 jobs:
@@ -22,22 +28,23 @@ jobs:
 
     steps:
       - name: Checkout release tag
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
-          ref: ${{ github.event.release.tag_name }}
+          ref: ${{ github.event.release.tag_name || inputs.tag }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 24
-          cache: npm
+          registry-url: https://registry.npmjs.org
+          package-manager-cache: false
 
       - name: Update npm
         run: npm install --global npm@latest
 
       - name: Check release version
         env:
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag }}
         run: |
           node --input-type=module -e '
             import { readFileSync } from "node:fs"
@@ -79,9 +86,19 @@ jobs:
       - name: Create checksums
         run: sha256sum release/* > release/SHA256SUMS
 
+      - name: Upload GitHub Release assets
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ github.event.release.tag_name || inputs.tag }}
+          files: |
+            release/*.tgz
+            release/*.zip
+            release/SHA256SUMS
+          overwrite_files: true
+
       - name: Publish npm package
         env:
-          IS_PRERELEASE: ${{ github.event.release.prerelease }}
+          IS_PRERELEASE: ${{ github.event.release.prerelease || false }}
         run: |
           PACKAGE_SPEC=$(node -p "const pkg = require('./package.json'); pkg.name + '@' + pkg.version")
 
@@ -95,13 +112,4 @@ jobs:
             DIST_TAG=next
           fi
 
-          npm publish release/*.tgz --access public --provenance --tag "$DIST_TAG"
-
-      - name: Upload GitHub Release assets
-        uses: softprops/action-gh-release@v2
-        with:
-          files: |
-            release/*.tgz
-            release/*.zip
-            release/SHA256SUMS
-          overwrite_files: true
+          npm publish --ignore-scripts --access public --tag "$DIST_TAG"