Use npm token for releases

[0xroylee]

What Changed

• Updated the tag-triggered release workflow to publish with secrets.NPM_TOKEN through NODE_AUTH_TOKEN.
• Added an explicit missing-token guard and npm whoami before npm publish.
• Kept provenance, public access, dist-tag selection, and already-published version skipping.

Why

• The tokenless/trusted-publishing attempt reached npm but failed authorization for the unscoped getsuperpower package.
• The release should use an npm token stored as the NPM_TOKEN GitHub secret.

How to Test

• rtk bun run check
• rtk ruby -e "require 'yaml'; YAML.load_file('.github/workflows/release.yml'); puts 'release workflow yaml ok'"

Additional Notes

• The NPM_TOKEN secret must be a token with publish permission for getsuperpower.
• Because this package/account has 2FA involved, the token must be an npm token configured to bypass 2FA for write/publish actions, otherwise the workflow will fail with EOTP again.