Removing registry-url stopped npm from attempting OIDC at all (ENEEDAUTH).
npm needs registry-url to know which registry to run the OIDC token exchange
against; the token-injection problem is avoided by simply never setting
NODE_AUTH_TOKEN on the publish step.