Fix turbo publish task: missing build + swallowed auth token

[alisonjlai]

Problem

Publish step failed for a package bump.

publish task depended on ^build (upstream packages only), so it never built itself — CI published a tarball missing dist/. It also declared no passThroughEnv, so turbo's strict env mode silently dropped YARN_NPM_AUTH_TOKEN before it reached yarn npm publish (YN0033).

Fix

-  "dependsOn": ["^build"],
+  "dependsOn": ["build"],
+  "passThroughEnv": ["YARN_NPM_AUTH_TOKEN"],

Testing

Verified via turbo run publish --dry-run=json: publish now depends on its own build task. Verified env passthrough with a temporary proof task (removed before commit): token was undefined without passThroughEnv, visible with it.