Releasing: allow npm publish on a new package's trusted publisher

[SandroMaglione]

Summary

These are lessons from the 0.9.0 release of @typeonce/oxlint-plugin-ritmo, added to the "Add a new package" section of RELEASING.md.

• Tick "Allow npm publish". npm's trusted publishers created since September 2026 allow only npm stage publish by default. The release workflow runs npm publish, so CI got 403 OIDC permission denied for this action until that box was ticked.
• Start a fresh run instead of re-running the failed job. The first attempt had already written its provenance to the Sigstore transparency log, so re-running the same job failed with TLOG_CREATE_ENTRY_ERROR (409). A new run (gh workflow run release.yml --ref main) signs new provenance and skips the versions already published.

Docs only, so there is no changeset.

🤖 Generated with Claude Code