fix(ci): treat npm OIDC exchange 201 as success in preflight

Empirically the npm registry returns HTTP 201 (Created) - not 200 -
when the OIDC token exchange succeeds and a fresh publish token is
issued. The preflight gate was only accepting 200 so every
correctly-configured package was flagged as missing. Accept any
2xx status; only treat 4xx/5xx as missing trust config.

.github/workflows/publish.yml

@@ -102,7 +102,9 @@ jobs:
               -H "Content-Type: application/json" \
               -d '{}')
 
-            if [ "${STATUS}" = "200" ]; then
+            # npm returns 200 or 201 when trusted publisher is configured (token issued).
+            # 404 means the package has no trusted publisher mapping for this workflow.
+            if [ "${STATUS}" -ge 200 ] && [ "${STATUS}" -lt 300 ]; then
               echo "OK   ${pkg}"
             else
               echo "FAIL ${pkg} (HTTP ${STATUS})"