fix(ci): NPM_TOKEN auth fallback for npm publish

[hyperpolymath]

Summary

Switch npm publish from OIDC Trusted Publisher to granular access token auth. Three publish attempts on v0.4.7 (and one each on prior tags going back to v0.4.1) returned the same 404 from npm — Trusted Publisher setup wouldn't take regardless of how the UI was configured. The token path is documented, reliable, and what npm uses in practice.

What changes

```diff
- name: Publish to npm
run: npm publish --provenance --access public

•    env:
  

•      NODE_AUTH_TOKEN: \${{ secrets.NPM_TOKEN }}
  

```

Two lines added. `actions/setup-node` already configures `registry-url` to npm, so `NODE_AUTH_TOKEN` is the conventional way to pass auth.

Provenance is preserved

The `--provenance` flag still works under token auth. The workflow's `permissions: id-token: write` is unchanged, so `npm publish --provenance` still generates a sigstore attestation inside the GitHub Actions OIDC environment. Token auth handles the upload; provenance attests what was published — these are separate.

Prerequisite (owner action, done in parallel)

A repo secret `NPM_TOKEN` must exist before this lands and the next re-tag fires the workflow. The token should be a granular access token scoped to:

• Packages: `@hyperpolymath/boj-server` only
• Permissions: Read and write

Created at https://www.npmjs.com/settings/~/tokens/granular/new.

JSR path unchanged

JSR Trusted Publisher works (v0.4.7 published successfully on the previous workflow run). The `publish-jsr` job is untouched.

Sequencing

Merge → user re-tags v0.4.7 → workflow uses NPM_TOKEN → npm gets 0.4.7. Glama re-scan window opens once the npm tarball is visible.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 31 issues detected

Severity	Count
🔴 Critical	19
🟠 High	5
🟡 Medium	7

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stale AI session file -- delete",
    "type": "stale",
    "file": "GEMINI.md",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/.github/scripts/validate-eclexiaiser.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/fireflag-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/ephapax-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence