docs: note that a first npm publish is manual under trusted publishing

[hunterbecton]

Why

The first @camp-dev release failed with ENEEDAUTH after the version PR merged, and the npm gotcha in AGENTS.md listed three causes that were all ruled out before the real one turned up.

What changes

The gotcha gains a fourth cause. A never-published package has no settings page on npmjs.com, so no trusted publisher can exist for it, and the workflow's OIDC exchange has nothing to match. The entry records the recovery used for 0.19.0 on 2026-09-08: publish by hand from outside the devEngines pin, add the same trusted publisher to each package with direct npm publish allowed, and push the tags changesets skipped.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 40103585-23b2-4190-b67b-ef3568240fda

📥 Commits

Reviewing files that changed from the base of the PR and between e55c838 and e7d27ce.

📒 Files selected for processing (1)

• AGENTS.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• Documentation
  • Expanded npm publishing troubleshooting guidance to cover packages that have never been published.
  • Added steps for completing an initial manual publish and configuring trusted publishing afterward.

Walkthrough

The change updates AGENTS.md with an additional npm OIDC failure cause and documents the manual first-publish procedure, trusted publisher configuration, and post-publish changeset tagging command.

Changes

npm publishing guidance

Layer / File(s)	Summary
Document unpublished-package publishing flow AGENTS.md	The npm publishing guidance now explains that unpublished packages can return ENEEDAUTH and documents the manual first publish, trusted publisher setup, and pnpm exec changeset tag steps.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to e7d27

This updates npm first-publish troubleshooting guidance and recovery steps. No concrete merge-blocking risk remains for the documented change.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main documentation change: the first npm publish must be manual when using trusted publishing.
Description check	✅ Passed	The description directly explains the ENEEDAUTH cause, the trusted publishing limitation for never-published packages, and the manual recovery steps documented by the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}