Hardening publishing & consuming

A practical look at reducing blast radius in npm publishing workflows — environment-gated OIDC publishing, limiting manual access, and what consumers can do on their end.