fix(ci): clear NODE_AUTH_TOKEN for npm OIDC, add dry-run test job

Author: davidfarah2003

.github/workflows/publish.yml

@@ -220,3 +220,37 @@ jobs:
     - name: Publish to npm
       run: npm publish --provenance --access public
       working-directory: sdk/typescript
+      env:
+        NODE_AUTH_TOKEN: ""
+
+  # Dry-run npm publish to verify OIDC auth works (manual trigger only)
+  test-npm-publish:
+    name: Test npm publish (dry-run)
+    if: github.event_name == 'workflow_dispatch'
+    needs: [build-kayba-tracing-ts]
+    runs-on: ubuntu-latest
+    environment:
+      name: npm
+    permissions:
+      id-token: write
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Set up Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '22'
+
+    - name: Install dependencies
+      run: npm ci
+      working-directory: sdk/typescript
+
+    - name: Build
+      run: npm run build
+      working-directory: sdk/typescript
+
+    - name: Dry-run publish
+      run: npm publish --provenance --access public --dry-run
+      working-directory: sdk/typescript
+      env:
+        NODE_AUTH_TOKEN: ""