fix(ci): drop NODE_AUTH_TOKEN so npm trusted publishing can run (#563)

NPM_TOKEN still 404s. If the packages now have a GitHub Actions
trusted publisher, NODE_AUTH_TOKEN would override OIDC and keep failing.

Co-authored-by: Cobus Greyling <cobusgreyling@Cobuss-MacBook-Pro-2.local>

Author: cobusgreyling

.github/workflows/release-loop-audit.yml

@@ -56,5 +56,5 @@ jobs:
           "
           npm publish --access public --provenance
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          # OIDC trusted publishing — do not set NODE_AUTH_TOKEN (it overrides OIDC)
           NPM_CONFIG_PROVENANCE: "true"

.github/workflows/release-loop-init.yml

@@ -53,5 +53,5 @@ jobs:
           # package.json keeps registry range (^1.x) for the published tarball
           npm publish --access public --provenance
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          # OIDC trusted publishing — do not set NODE_AUTH_TOKEN (it overrides OIDC)
           NPM_CONFIG_PROVENANCE: "true"

.github/workflows/release-loop.yml

@@ -51,6 +51,5 @@ jobs:
         working-directory: tools/loop
         run: npm publish --access public --provenance
         env:
-          # Trusted publisher OIDC 404'd (npm GAT). Fall back to repo NPM_TOKEN.
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          # OIDC trusted publishing — do not set NODE_AUTH_TOKEN (it overrides OIDC)
           NPM_CONFIG_PROVENANCE: "true"