Fix OIDC Trusted Publishing workflow

[graygilmore]

Summary

• Remove broken if condition on the "Test OIDC Token" step that referenced a non-existent step ID (version), causing the OIDC sanity check to silently never run
• Remove unnecessary NPM_TOKEN: '' override from the changesets step env (the workflow-level NPM_TOKEN was already removed in a prior commit)
• Align changeset config access from restricted to public to match actual publish behavior (all 12 publishable packages already declare publishConfig.access: "public")

Context

The recent switch to OIDC Trusted Publishing successfully publishes 9/11 packages. The 2 remaining failures (@shopify/codemirror-language-client and @shopify/theme-graph) are caused by missing npm-side Trusted Publishing configuration, which is being handled separately.

Test plan

• Merge this PR
• Verify the release workflow runs successfully on push to main
• Confirm the OIDC test step actually executes (was previously silently skipped)
• Once npm-side config is added for the 2 failing packages, verify all 11 packages publish successfully

🤖 Generated with Claude Code