ci: restore npm CI and OIDC publishing

[mulhamna]

Summary

• run CI validation with Node.js/npm and the committed package-lock.json
• keep Bun for the runtime smoke test
• preserve npm trusted publishing with id-token: write and npm provenance
• keep Bun available in the publish job for the Bun-based release check

Root cause

The merged Bun migration caused the existing npm publish workflow to fail with exit code 127 because it still expected the Node/npm workflow assumptions while the migrated scripts use Bun.

Validation

• workflow commands mirror the committed package scripts
• CI and publish workflow use the npm lockfile for dependency installation