bun publish authenticates via NPM_CONFIG_TOKEN (its documented CI env
var), not NODE_AUTH_TOKEN (npm/yarn convention) nor an ad-hoc $HOME/.npmrc
(unread). Wire the NPM_TOKEN secret into NPM_CONFIG_TOKEN. Fixes the
'missing authentication' publish failure that pinned npm at 0.1.59.