Fix npm publish auth in CI workflow

Write .npmrc with auth token before publishing — NODE_AUTH_TOKEN alone
is not picked up by npm without a registry-scoped config entry.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/publish.yml

@@ -3,7 +3,7 @@ name: Publish to npm
 on:
   push:
     tags:
-      - "v*"
+      - 'v*'
 
 jobs:
   publish:
@@ -17,6 +17,8 @@ jobs:
 
       - run: bun install
 
-      - run: npm publish
+      - run: echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - run: npm publish