ci(publish): write token to NPM_CONFIG_USERCONFIG path

setup-node@v4 sets NPM_CONFIG_USERCONFIG to a temp .npmrc — pnpm picks
THAT up, not $HOME/.npmrc. Write the token to that exact path so the
publish step actually authenticates.

.github/workflows/publish.yml

@@ -44,12 +44,13 @@ jobs:
       - run: corepack enable && corepack prepare [email protected] --activate
 
       - name: Configure npm auth (npmjs.org)
-        # Bake the token directly into .npmrc — pnpm does NOT expand
-        # ${VAR} references in .npmrc, so the literal token has to be on
-        # disk for `pnpm publish` to authenticate. Write to $HOME so we
-        # don't clobber the repo's pnpm config (link-workspace-packages).
+        # Bake the token directly into the userconfig .npmrc — pnpm does
+        # NOT expand ${VAR} references in .npmrc, so the literal token
+        # has to be on disk. setup-node@v4 sets NPM_CONFIG_USERCONFIG to
+        # a temp path; we write to that exact path so pnpm picks it up.
         run: |
-          cat > "$HOME/.npmrc" <<NPMRC
+          target="${NPM_CONFIG_USERCONFIG:-$HOME/.npmrc}"
+          cat > "$target" <<NPMRC
           registry=https://registry.npmjs.org/
           @luxfi:registry=https://registry.npmjs.org/
           //registry.npmjs.org/:_authToken=${NPM_TOKEN}

package.json

@@ -1,6 +1,6 @@
 {
   "name": "bridge",
-  "version": "1.1.5",
+  "version": "1.1.6",
   "private": true,
   "description": "Lux Bridge - Decentralized cross-chain bridge using MPC",
   "packageManager": "[email protected]",