MANUAL RUN: npm trusted publishing for the @rustybuns packages #662

.github/workflows/npm-publish.yml (from #650) publishes with npm trusted publishing, so no npm token lives anywhere. npm has to be told to trust that workflow, which needs your npm login:

For each of @rustybuns/ports, @rustybuns/shell-bun, @rustybuns/native, @rustybuns/cli on npmjs.com → package → Settings → Trusted Publisher → GitHub Actions:

• Organization or user: QuinnsCode
• Repository: RustyBuns
• Workflow filename: npm-publish.yml
• Environment: npm

Then, once the next release has gone out from CI (push tag v<version>), set each package's "Publishing access" to Require two-factor authentication and disallow tokens, so a laptop token can't publish any more.

Check: the version page on npmjs.com shows the provenance badge linking to the run.