Fix npm automation token or configure Trusted Publishing

[EShener]

Status

The npm package is published at @eshen_fox_mie/agent-ready, but automated release publishing is not fully working yet.

What happened

• v0.1.24 GitHub release triggered the Publish npm workflow, but npm rejected the token with: You may not perform that action with these credentials.
• A new NPM_TOKEN was configured.
• v0.1.25 GitHub release triggered the workflow again. This time npm accepted the token further, signed provenance, then failed with EOTP, meaning the token still requires one-time password confirmation.
• Manual publish can work through web confirmation, but that defeats unattended automation.

Desired outcome

Use one of these options:

1. Replace NPM_TOKEN with a real npm Automation Token that can publish without OTP.
2. Configure npm Trusted Publishing for this package and GitHub Actions workflow.

Acceptance criteria

• A new release can publish npm without manual web confirmation.
• npm view @eshen_fox_mie/agent-ready version matches the latest GitHub release tag.
• The Publish npm workflow succeeds on a release event.

References

• Workflow: https://github.com/EShener/agent-ready/actions/workflows/npm-publish.yml
• Failed v0.1.25 run: https://github.com/EShener/agent-ready/actions/runs/26391468540

[EShener]

Repository-side Trusted Publishing preparation is now on main in 6b636a4.

What changed:

• Updated .github/workflows/npm-publish.yml to use Node 24 with id-token: write and no NODE_AUTH_TOKEN.
• Publish step now runs npm publish --access public, so npm CLI can use GitHub Actions OIDC once the package has a Trusted Publisher configured.
• Added docs/npm-publishing.md with the exact npm package settings needed:
  • Package: @eshen_fox_mie/agent-ready
  • Publisher: GitHub Actions
  • Organization/user: EShener
  • Repository: agent-ready
  • Workflow filename: npm-publish.yml
  • Allowed action: npm publish
• Linked publishing docs from README, release notes, and growth playbook.

Verification:

• npm run check
• npm test (78 passing)

Remaining manual step before this issue can close:

• Configure Trusted Publishing on npmjs.com for the package. After that, publish v0.1.26 and verify npm view @eshen_fox_mie/agent-ready version matches the release tag.

Reference: https://docs.npmjs.com/trusted-publishers/