The npm package has trusted publishers (OIDC) configured. Remove manual token auth — let GitHub Actions OIDC handle it.