fix(release): pass npm token to publish

[drewstone]

Summary

• bind the repo NPM_TOKEN secret to NODE_AUTH_TOKEN for the npm publish step
• set the tangle-network/traces repo NPM_TOKEN secret from the validated local COMPANY_NPM_TOKEN

Diagnosis

• Publish failed after typecheck/test/build at npm upload with E404
• repo had no NPM_TOKEN secret before this fix
• local COMPANY_NPM_TOKEN authenticates as drewstone and has read-write access to @tangle-network/traces

Verification

• gh-drew secret list --repo tangle-network/traces shows NPM_TOKEN updated at 2026-07-02T05:10:41Z
• npm whoami with COMPANY_NPM_TOKEN -> drewstone
• npm access list packages @tangle-network includes @tangle-network/traces: read-write
• pnpm typecheck
• pnpm test
• pnpm build
• git merge-tree --write-tree origin/main HEAD

[tangletools]

✅ Auto-approved drewstone PR — 6984e74a

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-07-02T05:12:06Z}