1.0.0

Drop OIDC for the bootstrap publish and add identity diagnostics

The run failed with E404 on PUT /@oihai%2fdsh-harness-trace. A scoped-package
permission failure is reported as 404 rather than 403, so the error alone does
not distinguish a bad token from a scope the account does not own.

- stop requesting id-token: write: npm sees ACTIONS_ID_TOKEN_REQUEST_URL and
  takes the OIDC path, which cannot work before the package is registered as a
  trusted publisher on npmjs.com
- publish with the one-off NPM_TOKEN secret again
- print registry, package name, whether NODE_AUTH_TOKEN arrived, and npm whoami
  (length only, never the value) so the next run pins down the account