fix(ci): split wasm RC publish into a token-based workflow

npm Trusted Publishing only allows one Trusted Publisher per package and
the calling-workflow check breaks for reusable workflows: configuring
the TP slot for release-please.yml's stable releases means RC dispatches
from rc-release.yml fail validation.

Move the wasm RC publish to a parallel reusable workflow,
publish-wren-core-wasm-rc.yml, that authenticates with NPM_TOKEN. The
existing publish-wren-core-wasm.yml stays as the OIDC variant used by
release-please.yml. Python publishes are unchanged.

Repo setup before merging:
- Add an NPM_TOKEN secret with publish access to @wrenai/wren-core-wasm.
- Update the npm Trusted Publisher Workflow filename from rc-release.yml
  to release-please.yml so the stable release path keeps working.

.github/workflows/publish-wren-core-wasm-rc.yml

@@ -0,0 +1,98 @@
+name: Publish wren-core-wasm to npm (RC, token-based)
+
+# Token-based variant of publish-wren-core-wasm.yml used by rc-release.yml.
+# npm Trusted Publishing only supports a single Trusted Publisher per package
+# and we want that slot reserved for stable releases triggered by
+# release-please.yml. RC publishes therefore authenticate with a classic
+# NPM_TOKEN secret instead of OIDC.
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: "Version number (e.g. 0.2.0-rc.1)"
+        required: true
+        type: string
+      tag_name:
+        description: "Git tag to checkout (e.g. wren-core-wasm-v0.2.0-rc.1)"
+        required: true
+        type: string
+      npm_tag:
+        description: "npm dist-tag"
+        required: false
+        type: string
+        default: "rc"
+    secrets:
+      NPM_TOKEN:
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  build-and-publish:
+    name: Build WASM + publish to npm (token-based)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag_name }}
+
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-unknown-unknown
+
+      - name: Cache Cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            core/wren-core-wasm/target/
+          key: wasm-cargo-${{ hashFiles('core/wren-core-wasm/Cargo.toml', 'core/wren-core-wasm/Cargo.lock') }}
+          restore-keys: wasm-cargo-
+
+      - name: Install wasm-pack
+        uses: taiki-e/install-action@v2
+        with:
+          tool: wasm-pack@0.14.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+
+      - name: Install npm dependencies
+        working-directory: core/wren-core-wasm
+        run: npm install
+
+      - name: Set version in package.json
+        working-directory: core/wren-core-wasm
+        env:
+          VERSION: ${{ inputs.version }}
+        run: npm version "$VERSION" --no-git-tag-version
+
+      - name: Build WASM (wasm-pack)
+        working-directory: core/wren-core-wasm
+        run: wasm-pack build --target web --release
+
+      - name: Build dist (TypeScript + copy)
+        working-directory: core/wren-core-wasm
+        run: npm run build:dist
+
+      - name: Run integration tests
+        working-directory: core/wren-core-wasm
+        run: npm test
+
+      - name: Publish to npm
+        working-directory: core/wren-core-wasm
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_TAG: ${{ inputs.npm_tag }}
+        run: npm publish --tag "$NPM_TAG" --access public

.github/workflows/rc-release.yml

@@ -146,14 +146,16 @@ jobs:
   publish-wren-core-wasm:
     needs: create-rc
     if: inputs.component == 'wren-core-wasm'
-    uses: ./.github/workflows/publish-wren-core-wasm.yml
+    # RC publishes use the token-based variant. The OIDC variant is reserved
+    # for stable releases driven by release-please.yml — npm only allows one
+    # Trusted Publisher per package.
+    uses: ./.github/workflows/publish-wren-core-wasm-rc.yml
     with:
       version: ${{ needs.create-rc.outputs.version }}
       tag_name: ${{ needs.create-rc.outputs.tag_name }}
       npm_tag: rc
-    permissions:
-      contents: read
-      id-token: write
+    secrets:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   create-release:
     needs: [create-rc, publish-wren-core-py, publish-wren, publish-wren-core-wasm]