Switch publish to NPM_TOKEN auth (OIDC E404 workaround)

Trusted publishing OIDC signs provenance but npm rejects the publish
with E404. Fall back to NPM_TOKEN automation token as a working
alternative. Provenance flag kept for supply chain attestations.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: mfassaie

.github/workflows/publish.yml

@@ -54,3 +54,5 @@ jobs:
 
       - name: Publish to npm
         run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}