The publish-main job relied on npm trusted publishing (OIDC) which broke after the repo rename from oh-my-opencode to oh-my-openagent. Adding explicit NODE_AUTH_TOKEN restores auth while --provenance still uses OIDC for Sigstore attestation. Fixes #2373