ci(release): remove publish workflow

.github/workflows/publish.yml

@@ -1,22 +0,0 @@
-name: Publish package
-
-on:
-  release:
-    types: [published]
-  workflow_dispatch:
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          registry-url: https://registry.npmjs.org
-      - run: npm publish --access public --provenance
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.gitleaks.toml

@@ -8,8 +8,6 @@ title = "pi-commandcode-provider secret scan"
   paths = [
     # Test fixtures use intentionally fake credentials.
     "^tests/",
-    # CI workflows reference NPM_TOKEN secret name
-    ".github/workflows/publish.yml",
   ]
 
 # ──────────────────────────────────────────────────────────

RELEASE.md

@@ -173,13 +173,13 @@ git tag -a v0.1.1 -m "Release 0.1.1"
 git push origin v0.1.1
 ```
 
-Publish stable:
+Publish stable locally:
 
 ```sh
 npm publish --tag latest --access public
 ```
 
-If npm asks for browser or OTP auth, run the publish command manually and complete the npm prompt.
+Publishing is intentionally manual/local; there is no GitHub Actions publish workflow. If npm asks for browser or OTP auth, complete the npm prompt locally.
 
 Verify npm: