Fix npm OIDC publish: restore registry-url and clear NODE_AUTH_TOKEN in publish steps

[pcholakov]

Summary

Followup to #95 which went too far.

• Restores registry-url in setup-node (required: this is what creates the .npmrc that enables npm's OIDC token exchange; without it, npm has no auth config at all -> ENEEDAUTH)
• setup-node with registry-url automatically exports NODE_AUTH_TOKEN=$GITHUB_TOKEN for subsequent steps; npm sees a non-empty token and uses it instead of OIDC, causing 404
• Fix: explicitly set NODE_AUTH_TOKEN: "" in both publish steps so npm sees an empty token and falls through to OIDC trusted publishing exchange

No NPM_TOKEN secret needed once this lands.

Test plan

• Merge and observe next snapshot publish succeeds via OIDC without NPM_TOKEN