npm now rejects Trusted Publishing token exchanges for issue_comment
runs, and the NPM_TOKEN snapit relied on has been dead since npm revoked
classic tokens. snapit.yml now only validates the /snapit request and
dispatches release.yml (already the trusted publisher for every package)
on the PR branch. There, the branch is built and packed without a
publish credential, and a job that runs no repository code validates the
tarballs and publishes them over OIDC.