Read standard npmrc tokens for local Pantry publishing

Problem

A local user can be authenticated successfully with npm whoami, while pantry publish --npm --no-oidc reports that no npm token exists. Pantry currently checks environment variables and ~/.pantry/credentials, but does not read the standard project or user .npmrc token locations used by npm.

This blocked the Pantry-based bootstrap publication of @stacksjs/bumpx@0.2.7 after the GitHub release workflow's token failed.

Required contract

• preserve environment variables as the highest priority
• read a project .npmrc before the user config
• honor NPM_CONFIG_USERCONFIG, otherwise use ~/.npmrc
• recognize registry-scoped :_authToken and unscoped _authToken keys
• trim optional matching quotes without logging token contents
• retain ~/.pantry/credentials and interactive prompt as later fallbacks
• unit-test parsing and precedence helpers

Implemented on main in c157d69 with documentation in f6cf854. Token lookup now supports environment variables, project npmrc, NPM_CONFIG_USERCONFIG or user npmrc, Pantry credentials, and finally interactive prompting. Parser tests cover registry-scoped and unscoped tokens. A real publish attempt found the existing npmrc token without prompting and reached npm authentication; trusted-publisher configuration remains the release-level follow-up.

Implemented in c157d69 and documented in f6cf854, f445abb, and 7d088dd. Token resolution now preserves environment priority, then reads the project npmrc, NPM_CONFIG_USERCONFIG or the user npmrc, Pantry credentials, and the interactive fallback without logging secrets. Parser and precedence tests cover registry-scoped and unscoped tokens plus quoted values. Released in v0.10.42 and retained in v0.10.43. Pantry CI run 29887331918 is green.

Release clarification: v0.10.42 contains the source commit, but its binary Releaser was superseded before asset publication. The first complete GitHub and npm release carrying this fix is v0.10.43, produced by successful Releaser run 29887332086.