Publishes to npm on tag push (v*) or manual trigger. Bypasses local 2FA issues by using NPM_TOKEN secret. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>