ci(publish): bake NPM token into ~/.npmrc + mark root private

Two fixes:
- pnpm does NOT expand ${VAR} references in .npmrc, so the literal
  NPM_TOKEN has to be on disk. Use unquoted heredoc to expand at write
  time; write to $HOME so the repo .npmrc (link-workspace-packages)
  stays intact.
- Mark the workspace root as private:true. Without it, pnpm publish -r
  tried to publish the 9MB 'bridge' workspace-root packfile to npm.

.github/workflows/publish.yml

@@ -44,15 +44,19 @@ jobs:
       - run: corepack enable && corepack prepare [email protected] --activate
 
       - name: Configure npm auth (npmjs.org)
+        # Bake the token directly into .npmrc — pnpm does NOT expand
+        # ${VAR} references in .npmrc, so the literal token has to be on
+        # disk for `pnpm publish` to authenticate. Write to $HOME so we
+        # don't clobber the repo's pnpm config (link-workspace-packages).
         run: |
-          cat > .npmrc <<'NPMRC'
+          cat > "$HOME/.npmrc" <<NPMRC
           registry=https://registry.npmjs.org/
           @luxfi:registry=https://registry.npmjs.org/
-          //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
+          //registry.npmjs.org/:_authToken=${NPM_TOKEN}
           always-auth=true
           NPMRC
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - run: pnpm install --frozen-lockfile || pnpm install
 

package.json

@@ -1,6 +1,7 @@
 {
   "name": "bridge",
-  "version": "1.1.4",
+  "version": "1.1.5",
+  "private": true,
   "description": "Lux Bridge - Decentralized cross-chain bridge using MPC",
   "packageManager": "[email protected]",
   "main": "index.js",