[mangelsnc]

v2.3.1 also failed to publish — the misleading 404 'not in this registry' had a second cause. With registry-url: https://registry.npmjs.org/ passed to actions/setup-node, setup-node writes an .npmrc with _authToken=${NODE_AUTH_TOKEN} and exposes a placeholder env var NODE_AUTH_TOKEN: XXXXX-XXXXX-XXXXX-XXXXX to every step. npm publish then prefers that placeholder token over the OIDC handshake, npm rejects, and we get the 404.

The fix is to drop registry-url from setup-node. npm 10 with id-token: write performs the OIDC handshake against the default registry on its own.

What was cleaned up

• Tag 2.3.1 and the GitHub Release 2.3.1 have been deleted (no npm package existed for it, so nothing to break for users).
• The [2.3.1] CHANGELOG entry has been folded into a new [2.3.2] entry with the additional fix described above.

Release procedure once this lands

git checkout main
git pull
git tag 2.3.2
git push origin 2.3.2

Test plan

• CI on this PR passes.
• After merge, pushing tag 2.3.2 runs the workflow end to end.
• npm view undisclosed@2.3.2 version returns 2.3.2.
• npm view undisclosed dist-tags.latest returns 2.3.2.
• Provenance attestation is visible on the npm package page.