Greptile Summary

This PR adds npm Trusted Publishing support so packages can be published from CI without a long-lived .npmrc token. When OIDC signals are present (NPM_ID_TOKEN env var or GitHub Actions ACTIONS_ID_TOKEN_REQUEST_* vars), aube publish now fetches a short-lived package-scoped token via the registry's /-/npm/v1/oidc/token/exchange/package/… endpoint and uses it for the PUT; if OIDC is absent or fails, it falls back to existing .npmrc auth.

• RegistryClient::request() is added as a public, auth-free HTTP builder so OIDC exchange calls and the trusted PUT share the registry's TLS/proxy client without accidentally sending a stale .npmrc token alongside the OIDC bearer.
• The trusted_publish_token flow is placed after the "already published" pre-flight check, and three BATS tests verify the full GHA OIDC → exchange → PUT path, the fallback-to-npmrc path, and the post-hook name-rewrite case.

Confidence Score: 5/5

The auth path change is well-guarded and safe to merge; OIDC is only attempted when explicit env signals are present and the fallback to configured .npmrc auth is exercised by a regression test.

The only inconsistency found is that exchange_npm_oidc_token propagates transport errors hard while npm_oidc_id_token soft-fails — this affects a narrow scenario and the common failure modes (non-2xx HTTP responses) are correctly soft-failed with fallback.

The exchange_npm_oidc_token function in crates/aube/src/commands/publish.rs could use a second look for transport-error fallback behaviour.

Important Files Changed

_{Reviews (4): Last reviewed commit: "fix(publish): fall back after oidc failu..." | Re-trigger Greptile}