ci: restore npm token auth for dist-tag promotion

.github/workflows/openclaw-npm-release.yml

@@ -333,7 +333,6 @@ jobs:
     environment: npm-release
     permissions:
       contents: read
-      id-token: write
     steps:
       - name: Require main workflow ref for promotion
         env:
@@ -411,17 +410,12 @@ jobs:
 
       - name: Promote beta to latest
         env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
         run: |
           set -euo pipefail
-          registry_token="$(node scripts/npm-oidc-exchange-token.mjs openclaw)"
-          userconfig="$(mktemp)"
-          trap 'rm -f "${userconfig}"' EXIT
-          chmod 0600 "${userconfig}"
-          printf '%s\n' "//registry.npmjs.org/:_authToken=${registry_token}" > "${userconfig}"
-
-          NPM_CONFIG_USERCONFIG="${userconfig}" \
-            npm dist-tag add "openclaw@${RELEASE_VERSION}" latest
+          npm whoami >/dev/null
+          npm dist-tag add "openclaw@${RELEASE_VERSION}" latest
           promoted_latest="$(npm view openclaw dist-tags.latest)"
           if [[ "${promoted_latest}" != "${RELEASE_VERSION}" ]]; then
             echo "npm latest points at ${promoted_latest}, expected ${RELEASE_VERSION} after promotion." >&2