Fix OIDC release authentication setup

[itsjling]

Summary

• stop setup-node from generating token-auth configuration in the protected OIDC publish job
• preserve the explicit npm registry used by all release lookups and publishing
• pin the tokenless workflow invariant with a regression assertion

Failure

The 0.11.0 release run passed preparation, then failed before any Git or npm mutation because setup-node v6 injected its placeholder NODE_AUTH_TOKEN when registry-url was configured. The finalizer intentionally rejects token authentication. The failed run left both v0.11.0 and diffsplain@0.11.0 absent.

Verification

• corepack pnpm run check
• pnpm test
• node --test tests/release-workflow.test.mjs tests/automation-trust.test.mjs
• pnpm exec fallow audit --root . --format json --changed-since origin/main
• git diff --check

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T13:35:25.270082Z	00d2f21	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[itsjling]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 00d2f21da7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".