[splincode]

Changes

• Separate verify and publish jobs: tests, package check and version/tag/main checks have no OIDC permissions
• OIDC id-token: write only in the npm publish job, behind npm-publish GitHub environment
• Pin checkout and setup-node to verified commit SHAs, disable publishing cache and persisted git credentials
• Require npm >= 11.5.1, use Node 24 and npm Trusted Publishing (no NPM_TOKEN)
• Prevent npm lifecycle scripts and dependency installation in the privileged publish job
• Document first publish bootstrap, exact npm Trusted Publisher settings, approval setup, 2-day validation window and release tags

Activation (maintainer steps)

1. If not already published, publish the first version locally as package owner.
2. Configure npm Trusted Publisher: Angular-RU / prettier-plugin-angular-comment / publish.yml / npm-publish; grant Allow npm publish.
3. Configure the GitHub npm-publish environment with required reviewers; protect release tags.
4. Increment package version on main, wait for CI, and push the matching vX.Y.Z tag.
5. After successful release, disable traditional token publishing on npm.

This PR does not trigger an npm publication or create a release tag.