Fix npm trusted publishing runtime

[hopeatina]

Summary

• Switch the release workflow to Node 24 and use the bundled npm runtime instead of globally upgrading npm during publish.
• Remove token-oriented registry-url setup so npm trusted publishing can use GitHub OIDC without a blank NODE_AUTH_TOKEN path.
• Bump package/plugin metadata to 0.7.33 and document the corrected release path.

Root Cause

v0.7.32 fixed the previous missing-token publish path, but the release job then failed before publish while trying to run npm install -g npm@latest because the hosted npm runtime could not resolve promise-retry. Using Node 24 avoids the fragile self-upgrade step and keeps publish on the supported trusted-publishing path.

Verification

• git diff --check
• version consistency check across package.json, package-lock.json, and openclaw.plugin.json
• npm run typecheck
• npm run test:hooks
• npm run build

Rollout

Create release v0.7.33 after merge. If npm still rejects publish, the remaining action is external package configuration: npm trusted publishing must be enabled for useorgx/openclaw-plugin and .github/workflows/publish.yml.