fix(ci): strip _authToken from .npmrc so OIDC takes precedence

After switching to npm Trusted Publishing the publish step still
returned 'PUT 404' because actions/setup-node injects an
'//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}' line into
.npmrc. With NODE_AUTH_TOKEN unset that placeholder evaluates to
an empty string, so npm tries an empty token before reaching for
the OIDC ID token and the registry rejects it.

- Add a step that strips any _authToken line from both project-
  local and $HOME/.npmrc before publishing, so npm CLI proceeds
  to OIDC token exchange.
- Bump publish commands to --loglevel verbose so future failures
  expose the actual auth path (provenance attestation, OIDC
  exchange, etc.) in workflow logs.

.github/workflows/publish-platform.yml

@@ -352,6 +352,17 @@ jobs:
         if: steps.check.outputs.skip_all != 'true' && steps.download.outcome == 'success'
         run: npm install -g npm@latest
 
+      - name: Strip token auth from .npmrc to force OIDC
+        if: steps.check.outputs.skip_all != 'true' && steps.download.outcome == 'success'
+        run: |
+          for f in .npmrc "$HOME/.npmrc"; do
+            if [ -f "$f" ]; then
+              sed -i.bak '/_authToken/d' "$f"
+              rm -f "$f.bak"
+              echo "Cleaned $f"
+            fi
+          done
+
       - name: Publish oh-my-opencode-${{ matrix.platform }}
         if: steps.check.outputs.skip_opencode != 'true' && steps.download.outcome == 'success'
         env:
@@ -361,9 +372,9 @@ jobs:
           cd packages/${{ matrix.platform }}
 
           if [ -n "$DIST_TAG" ]; then
-            npm publish --access public --provenance --tag "$DIST_TAG"
+            npm publish --access public --provenance --tag "$DIST_TAG" --loglevel verbose
           else
-            npm publish --access public --provenance
+            npm publish --access public --provenance --loglevel verbose
           fi
         timeout-minutes: 15
 
@@ -382,8 +393,8 @@ jobs:
              package.json > tmp.json && mv tmp.json package.json
 
           if [ -n "$DIST_TAG" ]; then
-            npm publish --access public --provenance --tag "$DIST_TAG"
+            npm publish --access public --provenance --tag "$DIST_TAG" --loglevel verbose
           else
-            npm publish --access public --provenance
+            npm publish --access public --provenance --loglevel verbose
           fi
         timeout-minutes: 15

.github/workflows/publish.yml

@@ -169,6 +169,17 @@ jobs:
           bunx tsc --emitDeclarationOnly
           bun run build:schema
 
+      - name: Strip token auth from .npmrc to force OIDC
+        if: steps.check.outputs.skip != 'true'
+        run: |
+          for f in .npmrc "$HOME/.npmrc"; do
+            if [ -f "$f" ]; then
+              sed -i.bak '/_authToken/d' "$f"
+              rm -f "$f.bak"
+              echo "Cleaned $f"
+            fi
+          done
+
       - name: Publish oh-my-opencode
         if: steps.check.outputs.skip != 'true'
         env:
@@ -176,9 +187,9 @@ jobs:
           NPM_CONFIG_PROVENANCE: true
         run: |
           if [ -n "$DIST_TAG" ]; then
-            npm publish --access public --provenance --tag "$DIST_TAG"
+            npm publish --access public --provenance --tag "$DIST_TAG" --loglevel verbose
           else
-            npm publish --access public --provenance
+            npm publish --access public --provenance --loglevel verbose
           fi
 
       - name: Check if oh-my-openagent already published
@@ -213,9 +224,9 @@ jobs:
           ' package.json > tmp.json && mv tmp.json package.json
 
           if [ -n "$DIST_TAG" ]; then
-            npm publish --access public --provenance --tag "$DIST_TAG"
+            npm publish --access public --provenance --tag "$DIST_TAG" --loglevel verbose
           else
-            npm publish --access public --provenance
+            npm publish --access public --provenance --loglevel verbose
           fi
 
       - name: Restore package.json