npm revoked all classic tokens. Workflow now requires NPM_TOKEN secret with granular access token for publishing.