Read standard npmrc tokens for local Pantry publishing

Problem

A local user can be authenticated successfully with npm whoami, while pantry publish --npm --no-oidc reports that no npm token exists. Pantry currently checks environment variables and ~/.pantry/credentials, but does not read the standard project or user .npmrc token locations used by npm.

This blocked the Pantry-based bootstrap publication of @stacksjs/bumpx@0.2.7 after the GitHub release workflow's token failed.

Required contract

• preserve environment variables as the highest priority
• read a project .npmrc before the user config
• honor NPM_CONFIG_USERCONFIG, otherwise use ~/.npmrc
• recognize registry-scoped :_authToken and unscoped _authToken keys
• trim optional matching quotes without logging token contents
• retain ~/.pantry/credentials and interactive prompt as later fallbacks
• unit-test parsing and precedence helpers