Publish 1.0.27 package after public type exports

[skulidropek]

Context\n\nPR #26 fixed the public type exports needed by downstream consumers, but the Release workflow failed before publishing the package to npm.\n\n## Evidence\n\n- Merged PR: https://github.com/ProverCoderAI/openapi-effect/pull/26\n- Failed Release workflow: https://github.com/ProverCoderAI/openapi-effect/actions/runs/27828780993\n- npm still reports latest published version as 1.0.22.\n- npm returns 404 for @prover-coder-ai/openapi-effect@1.0.27.\n\nFailed publish excerpt from the workflow log:\n\n\nnpm error 404 Not Found - PUT https://registry.npmjs.org/@prover-coder-ai%2fopenapi-effect - Not found\nnpm error 404 '@prover-coder-ai/openapi-effect@1.0.27' is not in this registry.\n\n\n## Downstream impact\n\nProverCoderAI/docker-git can typecheck against the PR artifact from pkg.pr.new, but cannot safely replace its local shim in the open PR until a normal npm version is available.\n\nSmoke validation against the PR artifact passed:\n\nbash\nrtk bun run --cwd packages/openapi typecheck\nrtk bun run --cwd packages/app typecheck\n\n\n## Requested fix\n\nFix npm publish permissions/configuration and publish @prover-coder-ai/openapi-effect@1.0.27 (or a newer patch version with the same public exports).\n

[skulidropek]

Update after installing repository-level Actions secret in ProverCoderAI/openapi-effect and rerunning Release workflow:\n\n- Secret is now present for the workflow; logs show npm_token: *** and npm auth config is written.\n- The failure changed from E404 Not Found to npm E403 Forbidden.\n- Current blocker is npm-side token capability/permission, not a missing GitHub secret.\n\nFailed rerun: https://github.com/ProverCoderAI/openapi-effect/actions/runs/27828780993\n\nRelevant error:\n\n\nE403 403 Forbidden - PUT https://registry.npmjs.org/@prover-coder-ai%2fopenapi-effect - Two-factor authentication or granular access token with bypass 2fa enabled is required to publish packages.\n\n\nNeeded next step: create/use an npm automation token or granular token with publish access to @prover-coder-ai/openapi-effect and bypass-2FA enabled, then update NPM_TOKEN and rerun the Release workflow.\n

[skulidropek]

Second rerun after explicitly refreshing the repository-level Actions secret:\n\n- NPM_TOKEN updated at 2026-06-19T19:04:56Z.\n- Release rerun completed at 2026-06-19T19:05:46Z.\n- Workflow receives the secret (logs show npm_token: *** and writes npm auth config).\n- Publish still fails with npm E403:\n\n\n403 Forbidden - PUT https://registry.npmjs.org/@prover-coder-ai%2fopenapi-effect - Two-factor authentication or granular access token with bypass 2fa enabled is required to publish packages.\n\n\nConclusion: GitHub repo secret wiring is correct. The remaining fix is to replace NPM_TOKEN with an npm automation token or granular access token that has publish access and bypass-2FA enabled for @prover-coder-ai/openapi-effect.\n\nRun: https://github.com/ProverCoderAI/openapi-effect/actions/runs/27828780993\n