fix(ci): use OIDC provenance and skip napi prepublish

- Add --provenance flag for OIDC trusted publishing
- Add --ignore-scripts to skip napi prepublish (avoids release creation)
- Remove debug token output

Terraphim AI

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: AlexMikhalev

.github/workflows/publish-bun.yml

@@ -452,23 +452,16 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
-          # Debug: verify token is set (shows first/last 4 chars only)
-          if [[ -n "$NODE_AUTH_TOKEN" ]]; then
-            echo "NODE_AUTH_TOKEN is set: ${NODE_AUTH_TOKEN:0:8}...${NODE_AUTH_TOKEN: -4}"
-          else
-            echo "ERROR: NODE_AUTH_TOKEN is not set!"
-            exit 1
-          fi
-
           if [[ "${{ inputs.dry_run }}" == "true" ]]; then
             echo "Dry run mode - checking package only"
-            npm publish --dry-run --access public --tag ${{ steps.strategy.outputs.npm_tag }}
+            npm publish --dry-run --access public --tag ${{ steps.strategy.outputs.npm_tag }} --provenance --ignore-scripts
           else
             echo "Publishing @terraphim/autocomplete to npm (Bun-compatible)"
             echo "Tag: ${{ steps.strategy.outputs.npm_tag }}"
 
-            # Publish with appropriate tag (GITHUB_TOKEN needed for napi prepublish)
-            npm publish --access public --tag ${{ steps.strategy.outputs.npm_tag }}
+            # Publish with provenance for OIDC trusted publishing
+            # --ignore-scripts skips napi prepublish which tries to create GitHub releases
+            npm publish --access public --tag ${{ steps.strategy.outputs.npm_tag }} --provenance --ignore-scripts
 
             echo "Package published successfully! (Bun users can install with: bun add @terraphim/autocomplete)"
           fi