The NPM_AUTH_TOKEN secret is expired (npm revoked classic tokens in
2025). Trusted Publishing authenticates the workflow itself via OIDC --
no secrets to rotate -- and generates provenance attestations.
Requires the GitHub Actions trusted publisher configured for this
package on npmjs.com.

Also remove the GitHub Packages publish job: the GitHub npm registry
only accepts scoped package names, so it cannot publish unscoped
react-smoothie (the job has been failing with ENEEDAUTH). Can be
revisited in v1 if a scoped alias is wanted.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>