fix(ci): use npm-publish environment in release job

[iamfj]

Summary

• bind release job to npm-publish environment so environment secret NPM_TOKEN resolves
• add npm auth preflight (test -n NODE_AUTH_TOKEN + npm whoami) before semantic-release

Root cause

NPM_TOKEN was configured as an environment secret, but the job did not declare environment: npm-publish, so NODE_AUTH_TOKEN was empty in the release step.

Validation

• inspected failed Actions log: NODE_AUTH_TOKEN empty in Run semantic-release
• verified workflow now references the environment and fails early if auth is missing

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ffaaedb8f0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Set prerelease publish dist-tag explicitly

This config enables prereleases on the next branch (branches: ["main", { name: "next", prerelease: "next" }]), but the publish command does not pass any npm tag. npm publish uses the configured tag (default latest; confirmed via npm config get tag, and npm publish --help shows [--tag <tag>]), so next prereleases can be published as latest and become the default install for users. The publish step should set a channel-aware dist-tag (e.g., next for prereleases).

Useful? React with 👍 / 👎.