[esitarz]

Summary

• Point setup-node at the npm registry so NPM_TOKEN is actually used
• Write the changelog body as a multiline Actions output so the GitHub release step receives it
• Run npm publish only when action-autotag created a new tag, so later pushes of the same version do not fail the workflow

Test plan

• Merge a version-bump PR and confirm Tag, Release, & Publish creates the release and publishes to npm
• Push a master commit that does not change package.json version and confirm the workflow succeeds without publishing