ci(npm): add manual_otp workflow_dispatch auth path

[johnnyhuy]

Summary

Adds a manual_otp workflow_dispatch auth path to npm-publish.yaml so releases can be unblocked when the OIDC trusted publisher path returns 404 'getskillet is not in this registry'. The legacy OIDC path is unchanged and remains the default for release: published events.

Changes

• .github/workflows/npm-publish.yaml:
  • Two new workflow_dispatch inputs: auth_method (oidc | manual_otp, default oidc) and npm_otp (2FA code, masked in logs).
  • New step Configure manual OTP auth that:
    • Validates secrets.NPM_TOKEN is present on the production environment.
    • Validates inputs.npm_otp is supplied.
    • Writes NODE_AUTH_TOKEN=${NPM_TOKEN} to $GITHUB_ENV, overriding the OIDC value from actions/setup-node.
    • Sets NPM_OTP_CONFIGURED=true so the publish steps know to pass --otp.
  • Publish package and Publish scoped alias steps now pass --otp="${NPM_OTP}" when the manual path is selected.
• docs/distribution/npm.md:
  • New "Manual OTP bootstrap publish" section documenting the prerequisite of adding NPM_TOKEN as an environment secret on production and the dispatch flow.

Consequences

• An environment secret NPM_TOKEN needs to be added manually on the production GitHub environment before this path can be exercised. (Cannot be done from this PR.)
• Anyone with workflow: write access to the repo and access to the production environment can dispatch with manual_otp. The OTP code is masked in logs but is visible in the dispatch payload. Recommend rotating the OTP after each dispatch and the NPM_TOKEN secret if it was ever exposed.

Testing

• mise run ci passes: 21 test files, 103 tests pass; npm publish dry-run succeeds.
• YAML validated with python3 -c "import yaml; yaml.safe_load(open('.github/workflows/npm-publish.yaml'))".
• Manual npm-publish.yaml dispatch with auth_method=oidc and the existing setup continues to use OIDC and is unchanged.

Follow-ups

• Resolve the underlying OIDC 404 so manual OTP is the exception, not the norm. Track separately.
• Once NPM_TOKEN is added as a production environment secret, document the bootstrap publish procedure in AGENTS.md so it's discoverable for future releases.