fix(publish-cross-org): drop NPM_TOKEN fallback, trusted-publishing only

The workflow had a NODE_AUTH_TOKEN env wired to secrets.NPM_TOKEN as a
fallback path for repos with a long-lived npm token. That defeats the
trust gate the topology depends on:

  - trusted-publishing minted via this workflow's `id-token: write`
    permission, scoped to (sourceRepo, workflowPath) on npmjs.com.
  - A long-lived NPM_TOKEN is scoped to the npm account — anyone who
    exfiltrates the secret gets publish rights for the whole scope, no
    workflow binding, no SHA pin, no expiry.

The two auth paths can coexist on npm's side, but having BOTH wired
here means a token leak goes undetected (publishes succeed via the
fallback even when the OIDC config is broken). Trusted-publishing is
the only auth path now; if npm rejects the OIDC token, the publish
fails loudly — which is the correct failure mode.

Per-package trusted-publisher config on npmjs.com must point at
SocketDev/socket-addon + this workflow before any real publish goes
through. The first dispatch will reveal whether that's configured.

Author: jdalton

.github/workflows/publish-cross-org.yml

@@ -69,10 +69,13 @@ jobs:
           # gh CLI inherits its token from GITHUB_TOKEN; this binding is
           # explicit so the publish.mts subprocess inherits it too.
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # NODE_AUTH_TOKEN is what npm publish reads. The provenance
-          # path mints a workflow-OIDC token; this fallback is for
-          # repos using a long-lived token.
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          # Auth is trusted-publishing only: `npm publish --provenance`
+          # mints an OIDC token from this workflow's `id-token: write`
+          # permission and npm verifies against the package's trusted-
+          # publisher config (configured per-package on npmjs.com,
+          # pointing at SocketDev/socket-addon + this workflow path).
+          # No NPM_TOKEN env on purpose — a long-lived token would
+          # widen the trust gate.
         run: node scripts/publish-cross-org.mts
 
       - name: Summarize publish