Set up npm trusted publishing and staged publishing

[amoeba]

npm lets us do trusted publishing and staged publishing.

See:

• https://docs.npmjs.com/trusted-publishers
  • Remove npm token we have now
• https://docs.npmjs.com/staged-publishing (can only be done after our first publish)