fix(ci): add build step before publish + pass NPM_TOKEN as NODE_AUTH_TOKEN

[sepehr-safari]

Summary

Fixes two issues in the release workflow that prevented npm publishing.

Root Causes

1. Missing build step — The release workflow ran changeset publish without building first. The CLI's dist/index.js didn't exist, causing No bin file found at dist/index.js warning and the publish failed.

2. NPM_TOKEN not reaching npm — The changesets action received NPM_TOKEN env var, but npm publish reads NODE_AUTH_TOKEN (set by actions/setup-node with registry-url). The NPM_TOKEN was empty in the logs, and even if set, npm wouldn't read it. Need to pass it as both NPM_TOKEN (for changesets detection) and NODE_AUTH_TOKEN (for npm auth).

Changes

• Added pnpm build step before the changesets publish action
• Added NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} to the changesets env

Important: Verify NPM_TOKEN Secret

The user should verify the NPM_TOKEN GitHub secret:

1. Go to Settings → Secrets and variables → Actions
2. Verify a secret named exactly NPM_TOKEN exists
3. The token should be a publish token (not read-only) from npm
4. The npm user must be a member of the @ocpp-debugkit org with publish permissions