ci: allow npm trusted publishing OIDC

[calltelemetry-jason]

Summary

• remove setup-node's token-oriented registry configuration so npm can exchange the GitHub OIDC identity
• add a parsed-workflow regression test scoped to the publish job
• bump the release candidate to 0.9.29

Root cause

The v0.9.28 publish attempts used npm 11.17.0 with id-token: write, but setup-node@v4 generated an empty _authToken configuration. npm fell through to an unauthenticated registry PUT and returned E404.

Validation

• build and typecheck
• 44 test files / 1,214 tests
• focused workflow regression test (red before fix, green after)
• actionlint
• npm pack --dry-run
• CodeRabbit finding fixed; independent final review clean

Checklist

• No secrets or credentials included
• OIDC-only publishing contract preserved
• Release versions synchronized

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Warning

Review limit reached

Next included review available in 37 minutes.

View limit details

Limit details: You’ve used the included review currently available. Your 157 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 1268c4b5-ad04-418d-b0f3-5a1971165370

📥 Commits

Reviewing files that changed from the base of the PR and between 0ec8541 and 3f6407b.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (4)

• .github/workflows/npm-publish.yml
• openclaw.plugin.json
• package.json
• src/infra/npm-publish-workflow.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!