fix: add NODE_AUTH_TOKEN to publish-main job for npm auth

The publish-main job relied on npm trusted publishing (OIDC) which
broke after the repo rename from oh-my-opencode to oh-my-openagent.
Adding explicit NODE_AUTH_TOKEN restores auth while --provenance
still uses OIDC for Sigstore attestation.

Fixes #2373

.github/workflows/publish.yml

@@ -213,8 +213,8 @@ jobs:
           fi
           npm publish --access public --provenance $TAG_ARG
         env:
+          NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
           NPM_CONFIG_PROVENANCE: true
-
       - name: Publish oh-my-openagent
         if: steps.check.outputs.skip != 'true'
         run: |
@@ -242,8 +242,8 @@ jobs:
           fi
           npm publish --access public --provenance $TAG_ARG || echo "oh-my-openagent publish may have failed (package may already exist)"
         env:
+          NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
           NPM_CONFIG_PROVENANCE: true
-
       - name: Restore package.json
         if: steps.check.outputs.skip != 'true'
         run: |