fix(publish): grant release perms to publish-napi, push only new tag

- publish.yml: add contents:write permission and GITHUB_TOKEN env to the
  publish-napi job so 'napi prepublish' can create the GitHub release
  (previously failed with 401 unauthorized).
- publish-version.sh: push only the new v${VERSION} tag instead of
  --tags, avoiding rejection from stale local tags that diverge from remote.

Author: TtTRz

.github/workflows/publish.yml

@@ -199,6 +199,9 @@ jobs:
   publish-napi:
     needs: build-napi
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
     defaults:
       run:
         working-directory: float-pigment-css-napi
@@ -247,6 +250,8 @@ jobs:
         run: pnpm run artifacts
 
       - name: Publish
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
           npm config set provenance true
           npm publish --access public

publish-version.sh

@@ -126,7 +126,7 @@ if [ -z "$(git status --porcelain)" ]; then
     fi
 
     # push to origin
-    if git push && git push --tags; then
+    if git push && git push origin "v${VERSION}"; then
         echo 'Git tag pushed.'
     else
         echo 'Git tag push failed! Abort.'