Update release workflow for OIDC (#3500)

Author: delucis

.changeset/empty-impalas-switch.md

@@ -0,0 +1,8 @@
+---
+'@astrojs/starlight-docsearch': patch
+'@astrojs/starlight-markdoc': patch
+'@astrojs/starlight': patch
+'@astrojs/starlight-tailwind': patch
+---
+
+This is the first release published with OIDC trusted publishing.

.github/workflows/release.yml

@@ -1,4 +1,5 @@
 name: Release
+permissions: {}
 
 on:
   push:
@@ -12,21 +13,23 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      pull-requests: write
       id-token: write
     steps:
       - name: Checkout Repo
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           # This makes Actions fetch all Git history so that Changesets can generate changelogs with the correct commits
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup PNPM
         uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
 
       - name: Setup Node
         uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
-          node-version: 18.20.8
+          node-version: 24.10.0
           cache: 'pnpm'
 
       - name: Install Dependencies
@@ -41,4 +44,4 @@ jobs:
           title: '[ci] release'
         env:
           GITHUB_TOKEN: ${{ secrets.FREDKBOT_GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_TOKEN: "" # See https://github.com/changesets/changesets/issues/1152#issuecomment-3190884868