ci: use Node 24 for trusted publishing

[ElbertePlinio]

Summary

• bump release workflow Node 20.19.0 -> 24 so npm trusted publishing (OIDC) runs on a supported runtime
• completes the picklab code slice (PR 2) of Migrate npm publishing to trusted publishing (OIDC) — kill NPM_TOKEN rotation pickforge-platform#23; the platform slice (PR 1) is already on main there

Refs pickforge/pickforge-platform#23 — issue stays open for the owner-side npmjs.com trusted-publisher configuration, one real OIDC publish per repo, and NPM_TOKEN secret cleanup.

Validation

• YAML parse clean; workflow token scan shows no NODE_AUTH_TOKEN/NPM_TOKEN in the publish path
• pin style matches pickforge-platform publish.yml (node-version 24); id-token: write, npm@11.5.1, and --provenance publish already present
• real OIDC publish is validated on the next tagged release (owner-gated)
• not release-note-worthy: publish infrastructure only, no user-facing change; UNRELEASED.md intentionally untouched

Local review: trivial risk class, main-session review.