fix(http-recorder): reuse npm release authentication

.github/workflows/http-recorder-release.yml

@@ -13,12 +13,16 @@ jobs:
   release:
     if: github.repository == 'anomalyco/opencode' && github.ref == 'refs/heads/dev'
     runs-on: ubuntu-latest
-    environment: npm
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - uses: ./.github/actions/setup-bun
 
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+
       - name: Verify package
         working-directory: packages/http-recorder
         run: |
@@ -26,10 +30,6 @@ jobs:
           bun typecheck
 
       - name: Publish beta
-        run: |
-          if [ -n "$NODE_AUTH_TOKEN" ]; then
-            npm config set //registry.npmjs.org/:_authToken "$NODE_AUTH_TOKEN"
-          fi
-          bun run release:http-recorder
+        run: bun run release:http-recorder
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

packages/http-recorder/RELEASE.md

@@ -24,7 +24,7 @@ bun run verify:package
 
 After the release PR reaches `dev`, manually dispatch the `http-recorder release` workflow from the `dev` branch. The workflow repeats the focused tests, builds and verifies the exact tarball in a clean npm consumer, and publishes it with provenance under the `beta` tag.
 
-The bootstrap release requires an npm automation token in the repository's `NPM_TOKEN` secret. After the package exists, configure npm trusted publishing for `.github/workflows/http-recorder-release.yml` and the `npm` GitHub environment, then remove the token so later releases use GitHub OIDC.
+The bootstrap release uses the repository's existing `NPM_TOKEN` secret because npm trusted publishing cannot be configured for a package that does not exist yet. After the package exists, configure its npm trusted publisher for repository `anomalyco/opencode` and workflow `http-recorder-release.yml`, then remove `NODE_AUTH_TOKEN` from the workflow so later releases authenticate through GitHub OIDC like the repository's other npm packages.
 
 Verify the result: