Craft npm target auth: temp .npmrc via npm_config_userconfig bypasses all default config

Craft's npm target creates a temporary .npmrc file containing //registry.npmjs.org/:_authToken=${NPM_TOKEN} and sets the npm_config_userconfig env var to point to it. This completely overrides npm's default config file lookup chain — the user's home .npmrc and project .npmrc are both bypassed. This is why OIDC (which relies on setup-node creating a properly configured project .npmrc) requires a separate code path that skips the temp file entirely. The pattern is used in both publishPackage() and getLatestVersion(). The npm_config_userconfig approach (instead of --userconfig CLI flag) was chosen for yarn compatibility.