fix(ci): wire NPM_TOKEN into publish steps — OIDC trusted publishing was never configured npm-side (#73)

Author: johnxie

.github/workflows/force-release.yml

@@ -32,4 +32,7 @@ jobs:
         run: yarn run publish
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # OIDC trusted publishing was never configured on npmjs.com (this
+          # workflow has failed on every dispatch since Feb 2026). Token fallback:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_CONFIG_PROVENANCE: true

.github/workflows/release.yml

@@ -51,4 +51,8 @@ jobs:
         run: yarn run publish
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # OIDC trusted publishing was never configured on npmjs.com, so every
+          # tokenless publish fails E404-on-PUT (provenance signs, PUT rejects).
+          # NODE_AUTH_TOKEN feeds the .npmrc written by setup-node's registry-url.
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_CONFIG_PROVENANCE: true