Release workflow reports a green npm publish that never happens #51

Summary

publish.yml runs on every published GitHub release. Its last step skips npm publish with exit 0 when NODE_AUTH_TOKEN is unset, so the run shows green even though nothing was published. The v0.1.4 run did exactly that ("NODE_AUTH_TOKEN is not configured; skipping npm publish.").

npm can never be this package's channel:

• The unscoped npm name pi-apply-patch belongs to an unrelated project.
• docs: install from GitHub instead of npm #42 made git the documented distribution: pi install git:github.com/code-yeongyu/pi-apply-patch, which resolves the release tag.

A step that looks like a publish and silently skips misleads anyone reading the run.

Expected

• A release run states what a release is: a verified tag distributed via git.
• It has no npm step and no id-token permission it doesn't use.
• It fails, rather than passes, when the release tag doesn't match package.json (the one release mistake that would ship a wrong version through git installs).

Acceptance

• publish.yml has no npm publish step and no id-token permission.
• A release run's summary says "distributed via git".
• A tag that doesn't match package.json fails the run.