ci: honor runtime npm auth token for publish gate

[cbusillo]

Summary

• make the npm publish gate use the same runtime token source as the publish steps
• allow a populated NODE_AUTH_TOKEN to enable publish when NPM_TOKEN is blank in the job environment
• fail publish steps clearly if the gate says publish but no auth token is available

Validation

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release.yml"); puts "yaml ok"'\n- git diff --check\n- ./build-fast.sh\n\nRefs Fix release preflight runner capabilities #108\nRefs Plan Every Code default branch and release identity #87