ci: use OIDC

[Mercy811]

Summary

Checklist

• Does your PR title have the correct title format?
• Does your PR have a breaking change?:

[Mercy811]

bugbot run

[cursor]

Skipping Bugbot: Bugbot is disabled for this repository

[macroscopeapp]

Gate the release workflow in release.yml with a releaseType input and enforce v8.x branch for release runs

Add releaseType choice input (release or dry-run), add branch protection check for release to require v8.x, run Release job on Node.js 24.x via matrix, upgrade to actions/checkout@v3 with fetch-depth: 0, and remove NPM_TOKEN from semantic-release steps.

📍Where to Start

Start with the workflow_dispatch inputs and Authorize job in release.yml.

---

Macroscope summarized 65db503.