fix: publish with npm trusted publishing

[yltw27]

Summary

Fixes the main release workflow so public package publishes use npm trusted publishing instead of requiring an npm token.

This also recovers the current state where @loveholidays/eval-kit@1.2.0 was versioned on main but not published to npm after the failed release job.

Changes

• Configure npm registry metadata in actions/setup-node.
• Detect whether the current package version is already published to npm.
• Run publish when changesets exist or the current version is unpublished.
• Publish with npm@11 and OIDC-backed trusted publishing, without NPM_TOKEN.

Verification

• pnpm lint
• pnpm typecheck
• pnpm test
• pnpm build
• git diff --check
• YAML parse check
• npm publish --dry-run --access public

CodeScene was waived for this PR by request; local CodeScene could not run because CS_ACCESS_TOKEN is not configured.