release: configure npm trusted publishers for GitHub Actions

Context

The correctly tagged v0.2.7 release is blocked at npm publication because the release workflow has no trusted-publisher relationship for either package. Token fallback reaches npm but the maintainer account requires an OTP, so CI must use npm OIDC instead of a long-lived bypass token.

Required publishers

• Package: @stacksjs/bumpx
• Package: bumpx-action
• GitHub owner: stacksjs
• Repository: bumpx
• Workflow: .github/workflows/release.yml

Acceptance criteria

• Both npm packages trust the exact GitHub Actions workflow.
• The release workflow publishes both packages without NPM_TOKEN.
• @stacksjs/bumpx and bumpx-action report version 0.2.7 in the public registry.
• The v0.2.7 GitHub release is created only after publication succeeds.
• The package release is linked back to the atomic branch/tag fix in #2007.

The npm access UI requires maintainer 2FA before these permission changes can be saved.

Configured and verified both npm trusted publishers with the native npm trust command: stacksjs/bumpx, workflow release.yml, publish permission. Releaser run 29885154087 attempt 2 succeeded, @stacksjs/bumpx and bumpx-action both resolve to 0.2.7, and the v0.2.7 GitHub release was created. This completes the OIDC publication follow-up to #2007.