fix(ci): resolve merge conflict markers in publish workflow

[tembo]

Summary

PR #103 ("Configure OSS publishing") was merged to master with unresolved Git merge conflict markers in .github/workflows/publish.yml. This leaves the publish workflow with invalid YAML — it will fail when a version tag is pushed.

Root Cause

The merge commit a0d6204 introduced two unresolved conflict regions in publish.yml:

1. actions/checkout version — conflict between @v6 (HEAD) and @v5 (PR branch). Resolved to @v6 (newer, aligns with the PR's stated intent to update action versions).

2. pnpm auth token configuration — HEAD had no auth token lines; the PR branch added pnpm config set lines for both npm and GitHub Packages registries. Resolved to keep the auth token lines, as they are required for the dual-registry pnpm publish step that PR Configure OSS publishing #103 introduced.

Note on Dependabot Updates workflow failure

The triggering CI failure was in the Dependabot Updates workflow (dynamic/dependabot/dependabot-updates), which failed with "Dependabot encountered an error performing the update." This is a Dependabot infrastructure failure (the updater's own internal error while processing a postcss transitive dependency update) — not a code issue. No repository changes can fix it; re-running the Dependabot update should resolve it.

The merge conflict markers in publish.yml are a separate issue discovered during investigation. No conflict markers were found in package.json, pnpm-lock.yaml, or any source files.