ci(publish): pin the trusted-publishing npm and add a token fallback

[drewstone]

What this changes

The npm publish is already tokenless. There is no NPM_TOKEN secret on this repository or on the tangle-network organization, and @tangle-network/agent-knowledge@13.0.1 carries an SLSA provenance attestation with _npmUser: "GitHub Actions" — the signature of an OIDC publish. So the trusted publisher for @tangle-network/agent-knowledge is already registered and working.

This makes that path deterministic and adds a break-glass fallback, matching agent-sdk #284 and agent-dev-container/.github/workflows/publish-sandbox-sdk.yml.

Change	Why
npm install -g npm@11.18.0 with an exact-version assertion, replacing npm@11	A floating npm@11 accepts any future 11.x. npm 12.0.0 ships a provenance publish that fails with MODULE_NOT_FOUND for sigstore. The OIDC floor is 11.5.1. Same pin agent-sdk release.yml carries.
NPM_CONFIG_PROVENANCE: 'true' on the publish-npm job	Requests an attestation on both the OIDC path and the fallback path, and covers a publish an npm lifecycle script starts. --provenance stays on the command.
A Configure npm auth step that writes an _authToken only when NPM_TOKEN is set	Break-glass for repairing a publish by hand. The secret is unset, so today's behavior does not change. A token set here takes precedence over OIDC, which is the agent-sdk #284 failure, so the step prints which path it took.

The publish job still takes no registry-url on setup-node. The empty _authToken line it writes blocks the OIDC exchange, and the new auth step also strips such a line before deciding.

permissions: contents: read + id-token: write were already present on publish-npm and are unchanged.

Release semantics: unchanged

• Trigger is still push on a v* tag or workflow_dispatch.
• The verify job still locks tag to package.json version.
• The publish is still idempotent: a version already on the registry is skipped.

Note: this repository has no tip-of-main rule for a release tag. It checks tag-to-version equality only, unlike agent-runtime, which also verifies that the tag sits on the tip of main or of its release/<major>.<minor>.x line. Out of scope here; worth adding separately.

Checks

• actionlint .github/workflows/publish.yml — clean (shellcheck available).
• bash -n on every run block in the file — clean.

Before merge

The npm trusted publisher already exists for @tangle-network/agent-knowledge. Nothing to register.

[tangletools]

✅ Auto-approved drewstone PR — a52d4865

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

This approval is provisional. It rests on the audit running. If the audit cannot run — for example the CLI bridge rejects it — this approval is dismissed rather than left standing, so an unrun check never reads as a passing one.

_{tangletools · auto-approval · reason: drewstone_author · 2026-09-02T03:24:20Z}