ci: switch npm publish to OIDC trusted publishing (#8454)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

ui/text/scripts/postinstall.mjs

@@ -4,7 +4,7 @@
 // optional dependency. Writes the result to a JSON file that the CLI reads at
 // startup so it can spawn the server automatically.
 
-import { writeFileSync, mkdirSync } from "node:fs";
+import { writeFileSync, mkdirSync, chmodSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -46,6 +46,13 @@ try {
   process.exit(0);
 }
 
+// Ensure the binary is executable (npm may strip permissions during packaging)
+if (process.platform !== "win32") {
+  try {
+    chmodSync(binaryPath, 0o755);
+  } catch {}
+}
+
 const outDir = join(__dirname, "..");
 mkdirSync(outDir, { recursive: true });
 writeFileSync(