fix(ci): move CARGO_REGISTRY_TOKEN to job-level env for cargo publish

The token was only set as a step-level env for cargo login,
making it invisible to subsequent cargo publish steps.
Cargo reads CARGO_REGISTRY_TOKEN automatically -- no login step needed.
Added token presence check for clearer CI diagnostics.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: Shahinyanm

.github/workflows/publish.yml

@@ -10,6 +10,8 @@ jobs:
   publish:
     name: cargo publish
     runs-on: ubuntu-latest
+    env:
+      CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}
     steps:
       - uses: actions/checkout@v4
 
@@ -19,10 +21,13 @@ jobs:
       - name: Cache cargo
         uses: Swatinem/rust-cache@v2
 
-      - name: cargo login
-        env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}
-        run: cargo login "$CARGO_REGISTRY_TOKEN"
+      - name: Verify token is set
+        run: |
+          if [ -z "$CARGO_REGISTRY_TOKEN" ]; then
+            echo "::error::CARGO_REGISTRY_TOKEN is empty. Check CRATES_IO_TOKEN secret."
+            exit 1
+          fi
+          echo "Token is set (length: ${#CARGO_REGISTRY_TOKEN})"
 
       - name: Publish task-journal-core
         run: cargo publish -p task-journal-core