The repository does not commit package-lock.json, so npm ci had nothing to install from.
Replaces the Drone pipeline: npmjs is where this package is distributed, and Verdaccio proxies it. No npm token: the workflow's OIDC identity is the npm trusted publisher, and npm records provenance for the tag's commit.
marc