fix(ci): remove --provenance to fix E404 npm publish (#1096)

* ci(publish): fix OIDC auth — sed _authToken from NPM_CONFIG_USERCONFIG

npm config delete targets the wrong file; setup-node writes to
$NPM_CONFIG_USERCONFIG. Use sed directly on that file to remove
the _authToken line so npm's OIDC exchange can authenticate.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* ci(publish): restore registry-url, guard sed on NPM_CONFIG_USERCONFIG

Without registry-url, NPM_CONFIG_USERCONFIG is unset and the sed step
fails. Add registry-url back (needed for OIDC exchange to work via npm),
guard the sed+cat with a file-existence check to handle both cases.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(ci): explicitly fetch GitHub OIDC token for npm trusted publishing

npm CLI does not automatically exchange OIDC tokens — it must be explicitly
fetched and set as NODE_AUTH_TOKEN. setup-node already writes
_authToken=${NODE_AUTH_TOKEN} to the npmrc; populating the env var with the
OIDC JWT lets the registry validate it against the Trusted Publisher config.

Replaces the sed-based _authToken removal with an explicit OIDC token fetch.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(ci): revert to sed approach now that OIDC Trusted Publishers are configured

Previously ENEEDAUTH because no Trusted Publisher was configured on the packages.
Now that both @sonicjs-cms/core and create-sonicjs have Trusted Publishers set up
on npmjs.com, removing _authToken from the npmrc lets npm auto-detect and exchange
the OIDC token automatically.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(ci): use NODE_AUTH_TOKEN secret (Granular Access Token) for npm publish

Remove the sed-based _authToken removal step. setup-node writes
_authToken=${NODE_AUTH_TOKEN} to the npmrc; the NODE_AUTH_TOKEN repo secret
(a npm Granular Access Token scoped to the published packages) provides auth
without requiring bypass2fa.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(ci): remove --provenance flag to isolate E404 publish error

The --provenance flag triggers an OIDC token exchange for provenance
signing, which may conflict with GAT-based auth causing E404.
Remove it temporarily to test if the GAT token works for publishing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: lane711

.github/workflows/publish.yml

@@ -45,25 +45,25 @@ jobs:
       - name: Publish @sonicjs-cms/core
         run: |
           if [ "${{ inputs.dry_run }}" = "true" ]; then
-            npm publish --workspace=@sonicjs-cms/core --provenance --access public --dry-run
+            npm publish --workspace=@sonicjs-cms/core --access public --dry-run
           else
-            npm publish --workspace=@sonicjs-cms/core --provenance --access public
+            npm publish --workspace=@sonicjs-cms/core --access public
           fi
 
       - name: Publish @sonicjs-cms/sdk
         run: |
           if [ "${{ inputs.dry_run }}" = "true" ]; then
-            npm publish --workspace=@sonicjs-cms/sdk --provenance --access public --dry-run
+            npm publish --workspace=@sonicjs-cms/sdk --access public --dry-run
           else
-            npm publish --workspace=@sonicjs-cms/sdk --provenance --access public
+            npm publish --workspace=@sonicjs-cms/sdk --access public
           fi
 
       - name: Publish create-sonicjs
         run: |
           if [ "${{ inputs.dry_run }}" = "true" ]; then
-            npm publish --workspace=create-sonicjs --provenance --access public --dry-run
+            npm publish --workspace=create-sonicjs --access public --dry-run
           else
-            npm publish --workspace=create-sonicjs --provenance --access public
+            npm publish --workspace=create-sonicjs --access public
           fi
 
       - name: Tag beta dist-tag