Upgrade lerna to v9 for OIDC trusted publishing (#330)

- Upgrade lerna from v8 to v9 (adds OIDC trusted publishing support)
- Remove registry-url, scope, and packages:write from release workflow
- Remove NPM_CONFIG_PROVENANCE env (automatic with OIDC)
- Update workspace typescript devDependency from ^4.8.4 to ^5.8.3
- Remove root typescript override (no longer needed)

.github/workflows/release.yml

@@ -59,7 +59,6 @@ jobs:
 
     permissions:
       contents: write
-      packages: write
       id-token: write
 
     env:
@@ -72,8 +71,6 @@ jobs:
         with:
           node-version: 24.x
           cache: "npm"
-          registry-url: 'https://registry.npmjs.org'
-          scope: '@actions'
 
       - name: Parse version from lerna.json
         run: |
@@ -101,6 +98,4 @@ jobs:
 
       - name: Publish packages
         run: |
-          lerna publish ${{ env.PKG_VERSION }} --yes --no-git-reset --no-git-tag-version
-        env:
-          NPM_CONFIG_PROVENANCE: 'true'
+          npx lerna publish ${{ env.PKG_VERSION }} --yes --no-git-reset --no-git-tag-version