fix(ci): OIDC publish without NPM_TOKEN

[cobusgreyling]

Retry path for loop 0.2.0 / loop-init 1.7.0 / loop-audit 1.9.0. Trusted publisher OIDC cannot run while NODE_AUTH_TOKEN is set.

[github-actions]

This PR changes paths that must run the real validate and audit workflows (tools, patterns, scripts, or CI).

Fork PRs from first-time contributors start with those workflows waiting for approval. A maintainer needs to open the Checks tab and click Approve and run workflows. Until that happens, branch protection will show the PR as blocked even after a review.

Content-only PRs (docs/, examples/, stories/, skills/, root markdown) skip this step — required checks are posted from this workflow instead.

— loop-engineering fork-pr-gate

[github-actions]

Loop Readiness Audit

Score: 100/100 (L3)

Strong loop readiness — good candidate for L3 with explicit gates.

Top suggestions

• Run the loop and commit changelog-drafter-state.md (or append loop-run-log.md) so Loop Ready can see a fresh timestamp
• Scaffold a harness: npx @cobusgreyling/loop-init . --with-foundry (or npx @cobusgreyling/harness-foundry init --from loop-engineering:daily-triage)
• Scaffold memory tiers: npx @cobusgreyling/loop-init . --with-memory
• Scaffold a fleet: npx @cobusgreyling/loop-init . --with-fleet

_{Posted by audit.yml · loop-audit docs}