I had missed the announcement that this is now available for npm: https://github.blog/changelog/2025-07-31-npm-trusted-publish...

Guess I know what I’ll be doing this weekend.