Fix publish workflow: add NODE_AUTH_TOKEN and --provenance flag

[Copilot]

All non-dry-run publish workflow runs fail because the npm publish step never sets NODE_AUTH_TOKEN. The actions/setup-node with registry-url creates an .npmrc referencing ${NODE_AUTH_TOKEN}, but nothing populates it.

• Add NODE_AUTH_TOKEN env var from secrets.NPM_TOKEN to the publish step
• Add --provenance flag — the workflow already declares id-token: write but never uses it

- name: Publish to npm
  if: ${{ !inputs.dry_run }}
  run: npm publish --access public --provenance
  env:
    NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

Note: The NPM_TOKEN repository secret must be an npm automation token, not a "publish" token (which requires OTP and will always fail in CI — this was the EOTP error seen in earlier runs).

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.