ci(release): pre-flight NPM_TOKEN check with actionable error annotation (refs #94)

[Abdeltoto]

👋 PR #3 of 3 from a Smartsheet power user (see #95 and #96 for context).

Problem

Issue #94 surfaced because the Release workflow's last several runs all failed with:

npm error code EINVALIDNPMTOKEN
npm error 401 Unauthorized - GET https://registry.npmjs.org/-/whoami

…which means the NPM_TOKEN repository secret is missing/expired/revoked. The actual fix lives in your repo settings, but the developer experience around it is rough today:

• semantic-release only fails after Checkout → Setup Node → Install → Build → Test (~3-5 min wasted per run).
• The error is buried in the @semantic-release/npm plugin output.
• Maintainers have to scroll through hundreds of lines to learn "rotate the token".
• A partial GitHub release is sometimes posted before the npm step fails.

Fix

This PR adds a tiny pre-flight step before semantic-release:

- name: Verify NPM_TOKEN
  env:
    NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
  run: |
    # Fails fast with a GitHub Actions error annotation if the secret is
    # missing, expired, or revoked — instead of crashing inside semantic-release.

What it does:

• If NPM_TOKEN is missing → ::error::Missing NPM_TOKEN annotation, immediate failure with instructions.
• If NPM_TOKEN is invalid → runs npm whoami against registry.npmjs.org, fails with ::error::Invalid NPM_TOKEN annotation pointing at the token-creation docs.
• If NPM_TOKEN is valid → prints the npm username and proceeds to the normal Release step (current behavior preserved).

The token is never written to the global npm config — it's piped through a scratch .npmrc.preflight that's deleted immediately after the check. No behavioral change for the happy path.

Why this isn't intrusive

• No changes to .releaserc.json.
• No changes to plugin order, branches, or release semantics.
• A successful run produces 1 extra log line (NPM_TOKEN is valid for npm user: ...).
• A failed run now displays a red annotation in the GitHub Actions UI saying exactly what to do.

Doesn't fix #94 by itself

The actual fix for #94 is to rotate the NPM_TOKEN secret in repo settings — that's an internal Smartsheet operation. This PR makes the failure mode for #94 (and any future expiry) loud, fast, and self-documenting so the next time it happens, the on-call sees the fix in 5 seconds instead of 5 minutes.

Test plan

• YAML syntax validated locally.
• Logic traced for all three branches (missing token / invalid token / valid token).
• npm test still 72/72 passed (no source changes).
• Token never persists past the step — scratch .npmrc.preflight is rm -f'd in both the success and failure paths.

Refs #94. Standalone PR — does not depend on #95 or #96.