fix: log oidc failures at warn level - #9924

What / Why

When a trusted publish fails, npm falls back to the existing auth and the user only sees ENEEDAUTH. The reason the OIDC flow gave up is logged at verbose, so nothing shows at the default log level and there is no hint that NPM_ID_TOKEN was even picked up. Finding out takes a rerun at a higher log level.

These failure paths now log at warn: the two id_token fetch failures from GitHub, the token exchange request error, the missing token in the exchange response, the provenance auto-enable failure, and the outer catch. warn rather than error because publishing still goes ahead on whatever auth was already configured, so none of these are fatal. The two Skipped because ... messages stay at silly, since running outside a trusted publishing setup is not a failure and should stay quiet.

One consequence worth calling out: a workflow that sets id-token: write for provenance but has no trusted publishing configured for the package will now see the exchange 404 as a warning on an otherwise successful publish. Happy to narrow it to the NPM_ID_TOKEN case if you would rather keep that quiet. The message wording is left alone to keep the diff to the levels.

Testing

The existing OIDC cases in test/lib/commands/publish.js already assert these exact log lines, so their expected level moved from verbose to warn. One case is added at the default log level, which is the part the issue is actually about: it fails on latest because nothing reaches stderr at all. npx tap passes with lib/utils/oidc.js still at 100% coverage.

References

Fixes #9923