Remove secrets-based step conditionals in reusable npm publish workflow; decide token vs OIDC at runtime.