chore: align tooling and hygiene with the org #464

Why?

cloud-components (CC) gets more contributors and pull requests (cloud-registry-ui and other apps depend on it). Its tooling and repository setup differ from the organization's other repositories (e.g. cloud-registry), Node.js 18 and 20 are end of life, and npm releases depend on one maintainer's personal, expiring token (2.0.0-alpha.44, .45 and .47 never reached npm).

What?

Align CC's tooling and repository hygiene with the organization, in small, reversible steps that keep the current maintainer flow (direct pushes to main, a v* tag cuts a release) working. No restructuring of the monorepo, no changes to component code. Docs hosting is out of scope.

Sub-issues (one pull request each, to be merged in this order):

• fix: add a .dockerignore for the docs image #463 and chore: remove leftovers and pin actions #465 (chore: remove leftovers, pin actions #469): .dockerignore, leftovers, action pins, workflow fixes
• build: move CI and Docker to Node.js 22 and 24 #466 (build: move CI and Docker to Node.js 22 and 24 #470): Node.js 22 and 24
• ci: npm trusted publishing and GitHub releases #467 (ci: npm trusted publishing and GitHub releases #473): npm trusted publishing and GitHub releases
• ci: single CI gate and contribution docs #468 (ci: single CI gate and contribution docs #474): CI workflow with a single gate, CONTRIBUTING.md, CODEOWNERS
• ci: remove the NPM_TOKEN fallback #471: remove the NPM_TOKEN fallback after the first release with trusted publishing

Settings that only maintainers can change (npm trusted publishers, changeset-bot app, rulesets for main and tags) are listed in the pull requests.

Acceptance criteria

• All sub-issues are closed.