[nicosuave]

The publish workflow has failed with ENEEDAUTH on every release. The trusted publisher on npm is configured correctly. A diagnostic run showed the token exchange returning 404 OIDC token exchange error - package not found, which matches npm/cli#9969: npm rejects GitHub's immutable OIDC sub claim, the default for repositories created after 2026-07-15.

This does not make the publish job pass. That depends on the upstream fix.

• docs/releasing.md records the blocker and the steps for publishing the CI-tested archive locally.
• The publish step logs at verbose level, so the next release shows the exchange result rather than only ENEEDAUTH.