ci: restore NPM_TOKEN for auth, keep --provenance for attestation

npm requires a token for auth — OIDC provenance is for signing only.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: devallibus

.github/workflows/validate.yml

@@ -132,3 +132,5 @@ jobs:
           else
             echo "Version $LOCAL already published, skipping."
           fi
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}