Fix ENEEDAUTH in publish workflow caused by empty NODE_AUTH_TOKEN override

[Copilot]

actions/setup-node@v4 with registry-url exports NODE_AUTH_TOKEN to $GITHUB_ENV (defaulting to github.token). The npm publish step's own env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} was overriding that with an empty string — step-level env: takes precedence over $GITHUB_ENV — because NPM_TOKEN was not set in the npm-publish environment. Result: blank auth token → ENEEDAUTH.

Changes

• .github/workflows/publish.yml — pass token: ${{ secrets.NPM_TOKEN }} to setup-node@v4 (the idiomatic path: the action exports the token to $GITHUB_ENV itself) and remove the now-redundant — and dangerous — step-level env: NODE_AUTH_TOKEN blocks from both publish steps:

  - uses: actions/setup-node@v4
    with:
      node-version: '22'
      registry-url: 'https://registry.npmjs.org'
      scope: '@open-pulseboard'
      cache: npm
  +   token: ${{ secrets.NPM_TOKEN }}
  
  - name: npm publish
    if: ${{ ... }}
  - env:
  -   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
    run: npm publish --access public --provenance

• package.json — normalize repository.url to git+https:// prefix to eliminate the npm publish warning about auto-correction.

NPM_TOKEN must be configured in the npm-publish GitHub environment for the publish to succeed.