The npm trusted publisher is registered against publish.yml (matching
featureflow-node-sdk); ci.yml is now the branch/PR test gate only.
CDN deploy uses the new ff-aws-deploy access key repo secrets.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>