Fix publish workflow npm auth resolution with explicit token fallback

[Copilot]

The publish Actions job failed at npm publish due to registry auth not resolving from the expected secret in all environments. This change makes token selection explicit and backward-compatible across current and legacy secret names.

• Workflow auth selection

  • Define both possible npm secrets at job scope:
    • NPM_TOKEN
    • NPM_AUTH_TOKEN
  • Run publish with NPM_TOKEN when set.
  • Fallback to NPM_AUTH_TOKEN only when NPM_TOKEN is empty.

• Publish step behavior

  • Replace single publish step with two mutually exclusive conditional steps so NODE_AUTH_TOKEN is always sourced deterministically.

env:
  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
  NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}

# preferred token
- if: ${{ env.NPM_TOKEN != '' }}
  env:
    NODE_AUTH_TOKEN: ${{ env.NPM_TOKEN }}
  run: make publish

# legacy fallback
- if: ${{ env.NPM_TOKEN == '' }}
  env:
    NODE_AUTH_TOKEN: ${{ env.NPM_AUTH_TOKEN }}
  run: make publish

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.27%. Comparing base (17a19dd) to head (8d85a52).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #112   +/-   ##
=======================================
  Coverage   86.27%   86.27%           
=======================================
  Files           6        6           
  Lines         102      102           
  Branches       20       20           
=======================================
  Hits           88       88           
  Misses          6        6           
  Partials        8        8           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.