perf: sequential publish in single job with OIDC token caching

[Farenheith]

Summary

Replace the matrix-strategy publish pipeline (one runner per library) with a single job that publishes packages sequentially. This eliminates per-runner overhead (~30s × N) and caches the OIDC JWT for reuse across libraries.

Changes

• Single job instead of matrix — one GitHub Actions runner, no parallel setup cost
• Dynamic package discovery — scans libs/*/ for non-private packages at runtime
• OIDC token caching — obtains the JWT once and reuses it within a 4-minute window (GitHub's OIDC tokens are valid ~5 min), avoiding repeated curl calls
• Sequential publish loop — each library runs release-it in order, tags/pushes before moving to the next

Key details

Token refresh logic:

NOW=$(date +%s)
# Token TTL is ~5 min; refresh if older than 4 min
if [ $((NOW - TOKEN_OBTAINED_AT)) -gt 240 ] || [ -z "$OIDC_TOKEN" ]; then
    OIDC_TOKEN=$(curl ... | jq -r '.value')
    TOKEN_OBTAINED_AT=$(date +%s)
fi

• Token TTL refresh threshold: 240s (4 min) — leaves 1 min buffer before GitHub's ~5 min expiry
• Packages discovered via: for lib in libs/*/; do node -p "require('./${lib}package.json').name" filtered by private != true

Publish summary

Accurate reporting of published vs skipped libraries:

=== Summary ===
Published:
  ✓ @codibre/fluent-iterable
Skipped (no new commits):
  ⏭️  augmentative-iterable
  ⏭️  @fluent-iterable/js-sdsl
  ⏭️  @fluent-iterable/rxjs
Successfully published 1 library(ies).

Build & lint

All passing on the branch.