ci(publish): harden token auth + self-hosted runner config

Roll up four workflow hardening fixes that were stuck on the R2.5 branch
(commits 4cc54ee, 999a7cf, 903537e, 4bb910b) — picked up here without
their root-package version bumps:

  - runs-on lux-build (self-hosted org runner; GitHub-hosted not authorised)
  - fetch-depth: 1 in actions/checkout (avoid 'cannot fetch both sha and
    refs/tags/v1.1.x' on self-hosted)
  - bake token into NPM_CONFIG_USERCONFIG path (pnpm does NOT expand
    ${VAR} references in .npmrc — literal token must be on disk)
  - accept NPM_TOKEN or NODE_AUTH_TOKEN, fail fast at auth step with a
    clear ::error:: message if both are blank (better than opaque pnpm
    publish failure)

Re-tagging v1.1.10 to retrigger the publish workflow with these fixes.

.github/workflows/publish.yml

@@ -24,11 +24,16 @@ permissions:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    # Self-hosted org runner. GitHub-hosted runners are not authorised for
+    # this org's billing plan.
+    runs-on: lux-build
     steps:
       - uses: actions/checkout@v4
         with:
-          fetch-tags: true
+          # On tag push the checkout action already resolves the tag ref;
+          # setting fetch-tags here on a self-hosted runner conflicts with
+          # the refspec the runner uses, so we leave it implicit.
+          fetch-depth: 1
 
       - uses: actions/setup-node@v4
         with:
@@ -39,14 +44,25 @@ jobs:
       - run: corepack enable && corepack prepare [email protected] --activate
 
       - name: Configure npm auth (npmjs.org)
+        # Bake the token directly into the userconfig .npmrc — pnpm does
+        # NOT expand ${VAR} references in .npmrc, so the literal token
+        # has to be on disk. setup-node@v4 sets NPM_CONFIG_USERCONFIG to
+        # a temp path; we write to that exact path so pnpm picks it up.
         run: |
-          cat > .npmrc <<'NPMRC'
+          token="${NPM_TOKEN:-$NODE_AUTH_TOKEN}"
+          if [ -z "$token" ]; then
+            echo "::error::No NPM token available (NPM_TOKEN nor NODE_AUTH_TOKEN set)"
+            exit 1
+          fi
+          target="${NPM_CONFIG_USERCONFIG:-$HOME/.npmrc}"
+          cat > "$target" <<NPMRC
           registry=https://registry.npmjs.org/
           @luxfi:registry=https://registry.npmjs.org/
-          //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
+          //registry.npmjs.org/:_authToken=${token}
           always-auth=true
           NPMRC
         env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - run: pnpm install --frozen-lockfile || pnpm install