ci: move the GitHub Packages credential out of the project .npmrc

[EliRobinson]

Moves the GitHub Packages credential out of the committed .npmrc and into a source pnpm trusts at every version. Split out of #4 so a CI-auth regression can be reverted on its own.

The trap

The repo-root .npmrc carried the credential as an env placeholder:

//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}

pnpm 10 stopped expanding environment variables in registry credentials read from a project .npmrc — that file is committed, so a hostile registry line could exfiltrate the token. The result is a version-dependent split:

	behavior
pnpm 9.15.0 (the pin in packageManager)	expands it — CI works today
pnpm 10+	ignores it — resolves to nothing

So the line works in CI, warns on every local command (Homebrew pnpm 11 shells out to the pinned 9.15.0, and the outer binary parses .npmrc first), and the day packageManager moves to pnpm 10 it silently stops authenticating. The failure mode then is a bare 401 from the registry that names no cause.

Confirmed the credential is genuinely required — the registry returns HTTP 401 unauthenticated, and CI has no other credential source.

The change

The scope→registry mapping stays in the project .npmrc; that's what it's for. Only the credential moves.

• CI writes the NODE_AUTH_TOKEN secret into the runner's ~/.npmrc in an explicit step before install, in all three jobs.
• Locally it becomes a one-time pnpm config set "//npm.pkg.github.com/:_authToken" <PAT> --global, replacing the per-shell export $(grep ... .env.local) that pnpm 10+ would ignore anyway. Verified this writes to ~/.npmrc.

Secret scoping

NODE_AUTH_TOKEN moves from job-level env to the auth step alone. It's now absent from the environment during pnpm install — where dependency lifecycle scripts run — and during the test and build steps. No other step needed it.

Docs

.env.example previously advertised NODE_AUTH_TOKEN as a value to fill in. It now explains why the credential doesn't belong in that file, so the next person doesn't re-add a line that cannot work. README gains an "Authenticate to GitHub Packages" step; AGENTS.md records the pnpm 10 rule as the reason.

Verification

• pnpm install --frozen-lockfile succeeds with the credential absent from the project .npmrc, and the warning is gone.
• Workflow YAML parses; all three jobs place the auth step immediately before their install, with the secret scoped to that step.
• CI on this PR is the real test of the runner path — it installs the private packages with the project .npmrc carrying no credential.