fix(ci): add NPM_TOKEN for publish authentication

Provenance (OIDC) handles attestation, but npm still requires a
granular access token for the actual PUT. Token scoped to upath only.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: c99b52f

Author: claude

.github/workflows/publish.yml

@@ -22,3 +22,5 @@ jobs:
       - run: npm test
       - run: npm run test:integration
       - run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}