fix(release): keep npm CLI publish for OIDC trusted publishing
Reverting to the gradle publish task would run without credentials: 6c8640f removed NPM_TOKEN from the workflow env, and the petuska plugin's bundled npm is not the OIDC-capable CLI. The assembleJsPackage dependency on npmBip32Wasm already makes the staged directory complete for the npm CLI path, and the smoke test guards the tarball contents. Co-Authored-By: Claude Opus 4.8 <[email protected]> Signed-off-by: Pat Losoponkul <[email protected]>