9a61c607ab
Empirically the npm registry returns HTTP 201 (Created) - not 200 - when the OIDC token exchange succeeds and a fresh publish token is issued. The preflight gate was only accepting 200 so every correctly-configured package was flagged as missing. Accept any 2xx status; only treat 4xx/5xx as missing trust config.