[joeblau]

Fixes the Medium finding from the Oct 27 security check: @bloxwap/chart was published from the self-hosted Mac minis with the long-lived NPM_TOKEN, no GitHub environment approval, and no npm provenance.

Changes

• The publish job in publish_npm.yml now runs on GitHub-hosted ubuntu-24.04. npm trusted publishing (OIDC) and provenance only work on GitHub-hosted runners (npm docs). That job is the only exception; every other job stays on the minis.
• environment: npm-release, permissions: contents: read, id-token: write, npm 11.6.1, npm publish --provenance.
• needs: on the security release gate (bloxwap/.github v1.1.0, 2a70724) is unchanged.
• NODE_AUTH_TOKEN is now scoped to the steps that need it and kept only as a transitional fallback. npm tries OIDC first and falls back to the token, so releases keep working before the npm Trusted Publisher is configured.
• The publish-auth check passes with no token when the GitHub OIDC environment is present, so NPM_TOKEN can be deleted later without breaking releases. It still fails closed when neither is available.
• Docs updated.

Setup (owner)

1. npmjs.com → @bloxwap/chart → Settings → Trusted publishing → GitHub Actions: organization bloxwap, repository chart, workflow publish_npm.yml, environment npm-release, allow npm publish.
2. GitHub → Settings → Environments → npm-release: add required reviewer(s). The job creates the environment with no protection the first time if it doesn't exist yet.
3. After the first release logs show an OIDC publish with provenance, remove the token fallback and set package publishing access to "Require 2FA and disallow tokens".

Validation

A temporary PR-only workflow ran the same publish path on ubuntu-24.04 up to npm publish --dry-run, with no secrets. It was removed before merge. actionlint and zizmor pass. Nothing was published.