fix(npm releases): match environment variable with GHA (#619)

a55698e changed the environment variable being set from GitHub Actions, following the naming convention suggested by the documentation.

However, we weren't using the same name in the .npmrc file that we copy into the working directory, and this one gets used instead of the one created by actions/setup-node.

.npmrc

@@ -1,2 +1,2 @@
 # NPM_TOKEN read from env or GH Secret (.github/workflows/release.yaml)
-//registry.npmjs.org/:_authToken=${NPM_TOKEN}
+//registry.npmjs.org/:_authToken=${NPM_AUTH_TOKEN}