test: cover publish flow non-interactive --json output

[crowlbot]

The deliverable for the agent-usability work calls for non-interactive / --json test coverage of both the create and publish flows. tests/agent.test.ts already covers create (--json --dry-run, non-interactive missing-flag) but had no coverage of the publish flow (the default/root command).

This adds one test exercising the publish path with a temp token against an unreachable endpoint, asserting the agent-facing contract:

• exit code 3 (AUTH) — the temp-token retry path surfaces AUTH_INVALID_TOKEN deterministically, no browser, no hang;
• stdout stays empty under --json (no partial output / progress / spinner leakage);
• the structured error envelope is the last line of stderr.

--org/--app are passed as flags so org/app resolve without a network round-trip, keeping the test hermetic. Mirrors the existing env list / whoami AUTH-path tests.