Replaces the Drone pipeline: npmjs is where this package is distributed, and Verdaccio proxies it. No npm token: the workflow's OIDC identity is the npm trusted publisher, and npm records provenance for the tag's commit.
