fix(ci): authenticate npm publish and drop release dependency cache

The publish job declared `id-token: write` and `environment: npm` but never
injected a registry credential, so the `.npmrc` written by `actions/setup-node`
resolved `${NODE_AUTH_TOKEN}` to an empty value and any dispatch would fail
with `ENEEDAUTH` before reaching the registry. That is why `0.4.0` reads as
released in `package.json` and `CHANGELOG.md` while `npm view` still returns
404 for `@qoderai/better-harness` (issue #65).

Pass `secrets.NPM_TOKEN` as `NODE_AUTH_TOKEN` on the publish step. A token is
required for the first publish specifically: npm configures a trusted publisher
in the package's own npmjs.com settings, which presupposes the package exists,
so OIDC cannot bootstrap a package that has never been published. The npm CLI
prefers OIDC when it detects one and falls back to a token otherwise, so this
step stays correct after a trusted publisher is bound and the token is removed.

Also replace `cache: npm` with `package-manager-cache: false`. setup-node v6
enables npm caching by default, and both npm's trusted-publishing guide and the
setup-node README recommend disabling dependency caching in jobs holding
elevated privileges.

Test: dependency-governance, plugin-manifests, and host-plugin-artifact 15/15;
release.yml parses as YAML with the token wired to the publish step. The
workflow itself was not dispatched, since a real publish is an irreversible
registry action and remains a maintainer decision.

Co-authored-by: QoderAI (Qwen 3.8 Max) <qoder_ai@qoder.com>

Author: phodal

.github/workflows/release.yml

@@ -18,8 +18,10 @@ jobs:
         with:
           node-version: 24.x
           registry-url: https://registry.npmjs.org
-          cache: npm
+          package-manager-cache: false
       - run: npm ci
       - run: npm test
       - run: npm run pack:verify
       - run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}