ci(npm-dist-tag): setup-node's registry-url shadowed the npmrc the step writes

The workflow added yesterday failed its first real run with `E401 — Unable to
authenticate, your authentication token seems to be invalid` on all fourteen packages,
which reads as a dead `NPM_TOKEN` secret. It is not.

`actions/setup-node` with `registry-url:` writes its own `.npmrc` and exports
`NPM_CONFIG_USERCONFIG` pointing at it. That config wins over `~/.npmrc`, so the
`~/.npmrc` the step writes from the secret is never read; npm authenticated with
setup-node's un-expanded `${NODE_AUTH_TOKEN}` placeholder instead, and the registry
rejected it. The run log shows both values side by side.

The failure mode is worth naming because it inverts the diagnosis: an E401 here says
"npm read a config you did not write", not "the secret is expired". Chasing the secret
would have replaced a working credential and left the workflow broken.

Fixed by dropping `registry-url:`, so this authenticates exactly the way
`publish-npm.yml` does — one mechanism for both npm paths, which is what makes the
workflow's own premise true: the token that publishes the set is the token that retags
it. `publish-npm.yml` was never affected; it uses `setup-bun`, and `bun publish` reads
`~/.npmrc`.

Also fails on the credential once, up front, instead of fourteen identical per-package
errors that look like a registry-side refusal of the operation itself.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NTcEKXTQMYt84fAjuw5A2M

Author: dmealing

.github/workflows/npm-dist-tag.yml

@@ -35,11 +35,16 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # NO `registry-url:` here. It makes setup-node write its own .npmrc and export
+      # NPM_CONFIG_USERCONFIG at it, which SHADOWS the ~/.npmrc the step below writes —
+      # npm then authenticates with setup-node's literal `${NODE_AUTH_TOKEN}` placeholder
+      # and returns E401 "token seems to be invalid" for every package, which reads as a
+      # dead secret rather than a shadowed config. Authenticate exactly the way
+      # publish-npm.yml does, so the token that publishes the set is the token that retags it.
       - name: Set up Node
         uses: actions/setup-node@v4
         with:
           node-version: '22'
-          registry-url: 'https://registry.npmjs.org'
 
       - name: ${{ inputs.action }} '${{ inputs.tag }}' across the lockstep set
         env:
@@ -51,6 +56,11 @@ jobs:
           echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
           trap 'rm -f ~/.npmrc' EXIT
 
+          # Fail on the credential, once, before touching 14 packages. Without this an
+          # auth problem arrives as fourteen identical per-package errors and looks like a
+          # registry-side refusal of the operation.
+          npm whoami >/dev/null 2>&1 || { echo "::error::NPM_TOKEN does not authenticate"; exit 1; }
+
           node scripts/publish-set.mjs > "${RUNNER_TEMP}/set.txt"
           test -s "${RUNNER_TEMP}/set.txt"