fix: missing npm token treated as trusted pub

[shavonn]

Description

Fixes a publish-auth bug where a missing npm-token was treated as "use Trusted
Publishers (OIDC)." That assumption breaks the common setup where you authenticate
via actions/setup-node + NODE_AUTH_TOKEN and deliberately don't pass a token to
this action: the action overwrote the .npmrc setup-node manages (wiping the auth
line) and then rm'd it, producing npm error code ENEEDAUTH against
https://npm.pkg.github.com — while logging the misleading "using Trusted
Publishers (OIDC)" message.

The auth mode is now resolved from what's actually present, in three distinct cases:

Condition	Auth	.npmrc
npm-token set	Token	Action writes a temporary .npmrc, removed after publish
No token, job has id-token: write (OIDC)	Trusted Publishers	Action writes a registry-only .npmrc, removed after publish
Neither	Existing npm auth (setup-node / NODE_AUTH_TOKEN / ~/.npmrc)	Left untouched — never written or deleted

OIDC is detected via ACTIONS_ID_TOKEN_REQUEST_URL, which GitHub sets only when
id-token: write is granted — the real signal for Trusted Publishers, rather than
inferring it from the absence of a token. Cleanup now only removes an .npmrc the
action itself wrote, so a file from a prior step is never deleted.

The logic is extracted into a new, unit-testable helper scripts/npm-auth.sh
(npm_auth_mode, registry_host, write_npmrc), matching the style of the
existing workspaces.sh / install.sh helpers.

Fixes # (issue)

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing usage to not work as expected)
• Refactor / internal change (no functional impact)
• Documentation update
• CI / tooling change

How Has This Been Tested?

Added tests/npm-auth.bats (10 tests) covering all three auth modes, token-beats-OIDC
precedence, registry-host normalization, exact .npmrc contents for token/OIDC modes,
and the two behaviors behind the bug: external mode writes nothing and does not clobber
a pre-existing .npmrc. Ran the full suite and bash syntax checks locally.

• bats tests/ passes (77 tests: 10 new + 67 existing)
• Added or updated tests covering the change
• Manually exercised the change end-to-end in a fork (Phase 1 / Phase 2 / npm publish, as applicable)

Test Configuration:

• Runner OS: ubuntu-latest
• Node version (if npm publishing is involved): 24
• Inputs exercised: publish-npm: true to GitHub Packages via actions/setup-node + NODE_AUTH_TOKEN (no npm-token); also token and OIDC modes

Checklist

• My code follows the style guidelines of this project (bash set -euo pipefail, quoted expansions)
• I have performed a self-review of my code
• I have added tests that prove my fix is effective or that my feature works
• New and existing tests pass locally with my changes
• I have updated the README and action.yml descriptions where relevant
• My commit messages follow Conventional Commits
• Any breaking changes (input renames, default changes, output changes) are clearly called out above