fix: force trusted publish without token auth

.github/workflows/publish.yaml

@@ -65,6 +65,7 @@ jobs:
           echo "  actor: ${{ github.actor }}"
           echo "  selected_channel: ${{ inputs.channel || 'n/a' }}"
           echo "  selected_bump: ${{ inputs.bump || 'n/a' }}"
+          echo "  node_auth_token_present: $([ -n \"$NODE_AUTH_TOKEN\" ] && echo yes || echo no)"
 
           WORKFLOW_FILE=$(node -e "
             const ref = process.argv[1] || '';
@@ -159,10 +160,14 @@ jobs:
       - name: Publish prerelease to npm
         if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.channel == 'next')
         run: npm publish --tag next --provenance
+        env:
+          NODE_AUTH_TOKEN: ""
 
       - name: Publish stable release to npm
         if: github.event_name == 'workflow_dispatch' && inputs.channel == 'latest'
         run: npm publish --tag latest --provenance
+        env:
+          NODE_AUTH_TOKEN: ""
 
       - name: Push version commit and tag
         if: github.event_name == 'workflow_dispatch' && inputs.channel == 'latest'