The 0.5.2 release published to npmjs.org successfully but the new
GitHub Packages publish step failed with:
npm error 403 403 Forbidden - PUT https://npm.pkg.github.com/...
Permission installation not allowed to Write organization package
Two fixes:
1. Add `packages: write` to the workflow's `permissions:` block. The
default GITHUB_TOKEN doesn't have package-write capability for the
org without an explicit grant.
2. Make both publish steps idempotent. Either step might succeed while
a later step fails (e.g. the gh-packages step today). Re-running
the workflow on the same tag would otherwise 409 on the
already-published registry. Now both steps `npm view` first and
skip-if-present.
0.5.3 is the first version cut from this updated workflow. 0.5.2 is
stranded on npmjs.org only — no consumer should ever pull it.