Fix npm trusted publishing release workflow

[hopeatina]

Summary

• switch the release workflow away from the missing NPM_TOKEN secret path and onto npm trusted publishing with provenance
• run releases on Node 22 and npm latest so GitHub OIDC publishing is supported
• bump the package, lockfile, plugin manifest, and changelog to v0.7.32
• document that npm trusted publishing must be configured for this workflow

Verification

• npm run typecheck
• npm run test:hooks
• npm run build
• git diff --check