ci: require canonical npm token for publishing

[cbusillo]

Summary

• treat NPM_TOKEN as the only credential that enables npm publishing
• avoid using ambient NODE_AUTH_TOKEN from self-hosted runners as publish evidence
• keep GitHub Release publishing green when NPM_TOKEN is intentionally absent

Validation

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release.yml"); puts "yaml ok"'\n- git diff --check\n- ./build-fast.sh\n\nRefs Fix release preflight runner capabilities #108\nRefs Plan Every Code default branch and release identity #87