fix(ci): add NODE_AUTH_TOKEN to npm publish steps

[wyattjoh]

Add `NODE_AUTH_TOKEN` to all three npm publish jobs so `actions/setup-node`'s generated `.npmrc` can authenticate against the registry. The previous state had no token at all in those steps.

Also adds `GH_TOKEN` to the `canary-publish-npm` step for consistency with the stable publish job.

TODO: Remove `NODE_AUTH_TOKEN` once OIDC trusted publishing is configured for this package on npmjs.com.

[wyattjoh]

Stack: npm-publishing-fixes

• fix(ci): add NODE_AUTH_TOKEN to npm publish steps #133 👈 this PR
  • refactor(scripts): consolidate releaser into scripts/lib #134
    • chore(ci): remove NODE_AUTH_TOKEN once OIDC trusted publishing is enabled #135

Part of a stacked PR chain. Do not merge manually.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0896c712-7f18-4f17-9e21-45ed23b411ab

📥 Commits

Reviewing files that changed from the base of the PR and between 79b2b1b and 78a0b40.

📒 Files selected for processing (2)

• .github/workflows/release.yml
• .github/workflows/snapshot.yml

---

📝 Walkthrough

Walkthrough

The pull request adds the NODE_AUTH_TOKEN environment variable set to ${{ secrets.NPM_TOKEN }} across multiple npm package publishing steps in GitHub Actions workflows. Specifically, this variable is injected into the publish steps in .github/workflows/release.yml (both stable and canary publish jobs) and .github/workflows/snapshot.yml (snapshot publish job). Additionally, GH_TOKEN: ${{ github.token }} is added to the canary publish step in the release workflow.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and concisely describes the main change: adding NODE_AUTH_TOKEN environment variable to npm publish workflow steps.
Description check	✅ Passed	The description clearly explains the changes made, including the addition of NODE_AUTH_TOKEN to npm publish jobs and GH_TOKEN to the canary job, with a note about future OIDC configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}