Publish TypeScript SDKs to npm with OIDC

[IxayWolf]

Summary

• Replace token-based Speakeasy npm publish jobs with local npm OIDC/trusted-publishing jobs.
• Keep the publish semantics we need: manual confirmation, build before publish, prerelease dist-tags, --access public, and --provenance.
• Remove NPM_TOKEN; publishing now relies on GitHub OIDC plus npm trusted publisher config.
• Use pinned npm@11.14.0 via npx -p for dependency installs with --ignore-scripts --min-release-age=7.
• Fold alpha publishing into the main SDK publish workflow via npm_tag.

Environment / secrets

• Workflows now use the GitHub environment named publish.
• MISTRAL_API_KEY is expected from the publish environment for the examples workflow.
• The temporary separate examples job was removed; examples run in the existing workflow job with the publish environment.

Required GitHub environment setup

• The publish environment must expose the needed secrets, including MISTRAL_API_KEY.
• Because PR workflows now declare environment: publish, the environment branch policy must allow PR branches too. Right now it only allows main, so PR checks are rejected before any runner steps start.

Required npm setup

Configure trusted publishers on npmjs.com for:

• @mistralai/mistralai: .github/workflows/sdk_publish_mistralai_sdk.yaml, env publish
• @mistralai/mistralai-azure: .github/workflows/sdk_publish_mistralai_azure_sdk.yaml, env publish
• @mistralai/mistralai-gcp: .github/workflows/sdk_publish_mistralai_gcp_sdk.yaml, env publish

All should point to repo mistralai/client-ts.

Verification

• root/Azure/GCP temp-copy install + build with npx -p npm@11.14.0 npm install --ignore-scripts --min-release-age=7
• workflow YAML parse check
• git diff --check

Note: npm@11.14.0 is used because it supports min-release-age and is older than 7 days as of May 15, 2026.