ci(release): fix the workspace reify that breaks trusted publishing

[ianwremmel-ai-agent]

The trusted publishing switch in #444 got the release job past npm auth, but
the next run died in prepare:

npm error code ETARGET
npm error notarget No matching version found for @code-like-a-carpenter/assert@2.4.1.
  at: npm version 3.6.1 --userconfig /tmp/120d47ff139d84a92ed936490954c498/.npmrc ...

@semantic-release/npm runs npm version with --userconfig pointed at a temp
file. On the token path set-npmrc-auth writes that file by concatenating every
npm config file it finds, ~/.npmrc included, which is how the job's
npm config set workspaces-update false reached it. Under trusted publishing
verify-auth returns before set-npmrc-auth, the temp file is never written,
and --userconfig pointed at a nonexistent path displaces ~/.npmrc.
workspaces-update reverts to its default of true, npm version reifies the
workspace, and the "*" ranges that multi-semantic-release just rewrote to this
run's unpublished versions fail to resolve.

Setting it as npm_config_workspaces_update instead puts it at npm's env config
level, which outranks every config file and is unaffected by --userconfig.

Also adds scripts/npm-trust, which registers GitHub Actions as the trusted
publisher for all 32 public workspace packages. npm stores that per package, so
this is a prerequisite for the OIDC exchange rather than an optimization, and a
new package will need a run of it (after one manual bootstrap publish, since the
registry will not configure a name that does not exist).

Nothing published and no tags were created in the failed run, so there is no
half-released state to unwind.

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 5d843de

Command	Status	Duration	Result
nx run-many --target build	✅ Succeeded	37s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

---

☁️ Nx Cloud last updated this comment at 2026-09-12 17:14:44 UTC

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.90%. Comparing base (8f464cc) to head (5d843de).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #445      +/-   ##
==========================================
+ Coverage   60.78%   60.90%   +0.12%     
==========================================
  Files          29       29              
  Lines        1614     1614              
  Branches      369      369              
==========================================
+ Hits          981      983       +2     
+ Misses        629      627       -2     
  Partials        4        4              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.