ci: fix ID token perms

[ashutosh-ukey]

Summary

Restore id-token: write in the reusable npm publish workflow so AWS OIDC auth works during publish

Why

• the publish pipeline is failing in Configure AWS Credentials before npm publish
• aws-actions/configure-aws-credentials is using role-to-assume, which requires a GitHub OIDC token
• the workflow only grants contents: read, so the job cannot mint that token

Details

Regression Context

• id-token: write was originally added in ffcaf51 (fix: allow OIDC token in publish pipeline (#25))
• it was removed in 40ee83f (chore(stepsecurity): update workflows to use custom hosted runners with built-in StepSecurity (#133))
• that regression stayed hidden until 27f4efe (ci: fix release-please wiring (#140)) fixed release gating and caused npm-publish to run again

Validation

• reviewed failed run 23300901189 and failing job 67761702334
• confirmed the job fails in Configure AWS Credentials with the log: Did you mean to set the id-token permission?