fix(release): restore npm publish credentials

[drewstone]

Summary

• restore the existing NPM_TOKEN repository secret for the npm publish step
• preserve npm provenance generation
• update the release workflow contract test

The v0.12.3 tag and package contents are unchanged. This restores the repository's existing publish path while npm trusted publishing remains unconfigured.

Checks

• pnpm typecheck
• pnpm test (683 passed)
• pnpm build
• pnpm check:package
• pnpm exec vitest run tests/publish-workflow.test.ts

[tangletools]

✅ Auto-approved drewstone PR — 24967769

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

This approval is provisional. It rests on the audit running. If the audit cannot run — for example the CLI bridge rejects it — this approval is dismissed rather than left standing, so an unrun check never reads as a passing one.

_{tangletools · auto-approval · reason: drewstone_author · 2026-09-02T05:03:41Z}