fix(npm): write authToken to .npmrc explicitly for pnpm publish

The recursive publish 404'd on every package (npm's obscured 'unauthenticated'):
setup-node's ${NODE_AUTH_TOKEN}-templated .npmrc is read by npm but not reliably
by pnpm publish. Write the token literally into .npmrc + set @hanzo:registry, and
add npm whoami as an auth diagnostic. .npmrc gitignored.

.github/workflows/publish.yml

@@ -276,7 +276,14 @@ jobs:
     # abort every package after them. Builds already ran above, so no publish-time
     # script is needed. `|| true` keeps one bad package from blocking the rest.
     - name: Publish all
-      run: pnpm -r publish --access public --no-git-checks --ignore-scripts || true
+      run: |
+        # setup-node writes a ${NODE_AUTH_TOKEN}-templated .npmrc that `npm` expands
+        # but `pnpm publish` does not reliably read — write the token literally so
+        # pnpm authenticates (a 404 on PUT is npm's obscured "unauthenticated").
+        echo "//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}" >> .npmrc
+        echo "@hanzo:registry=https://registry.npmjs.org/" >> .npmrc
+        npm whoami || echo "::warning::npm whoami failed — NPM_TOKEN invalid or lacks @hanzo publish rights"
+        pnpm -r publish --access public --no-git-checks --ignore-scripts --report-summary || true
       env:
         NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 

.gitignore

@@ -65,3 +65,4 @@ build/
 .next/
 *.log
 tmp/
+.npmrc