fix: wire NPM_TOKEN into release and canary publish steps

Adds registry-url to setup-node so .npmrc is configured, passes
NPM_TOKEN to changesets/action for actual releases, and sets
NODE_AUTH_TOKEN for the canary snapshot step.

The secret was lost when the repo transferred to callstackincubator.
Add NPM_TOKEN as a repository secret to restore publishing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: piotrski

.github/workflows/release.yml

@@ -25,6 +25,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: '22'
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Install dependencies
         run: bun install
@@ -55,10 +56,12 @@ jobs:
           createGithubReleases: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Publish canary snapshot
         if: steps.changesets.outputs.published != 'true'
         env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_CONFIG_PROVENANCE: true
         run: |
           git checkout ${{ github.sha }}