ci(npm): allow token bootstrap before trusted publishing

Author: YNDmitry

.github/RELEASE_CHECKLIST.md

@@ -24,7 +24,8 @@ cd playground/wfkit
 bun run build
 ```
 
-Before cutting the first npm release, make sure npm trusted publishing is configured for `@flowmetelev/wfkit` with:
+For the first npm release, use a publish-capable `NPM_TOKEN` if the package does not exist yet.
+After `@flowmetelev/wfkit` exists on npm, configure trusted publishing with:
 
 - owner: `flowmetelev`
 - repository: `wfkit`

.github/workflows/publish.yml

@@ -134,3 +134,5 @@ jobs:
         if: steps.version.outputs.should_publish_npm == 'true'
         working-directory: npm
         run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

README.md

@@ -262,8 +262,11 @@ After that:
 2. open and merge the PR into `main`
 3. GitHub Actions creates the release automatically if that version tag does not already exist
 
-The npm publish step uses npm trusted publishing via GitHub Actions OIDC.
-Before the first release, configure a trusted publisher for `@flowmetelev/wfkit` in npm and point it at:
+The npm publish step is set up for npm trusted publishing via GitHub Actions OIDC.
+For the first release, you can keep a publish-capable `NPM_TOKEN` as a bootstrap path.
+After `@flowmetelev/wfkit` exists on npm, configure a trusted publisher and then remove the token.
+
+Trusted publisher settings for `@flowmetelev/wfkit`:
 
 - owner: `flowmetelev`
 - repository: `wfkit`