Track NPM_TOKEN Actions secret in Pulumi

Declare the NPM_TOKEN repository secret consumed by the release
workflow. Value is supplied out-of-band via stack config:
pulumi config set --secret devToolkit:npmToken <token>

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: kin0992

infra/Pulumi.prod.yaml

@@ -2,3 +2,5 @@ config:
   devToolkit:repoName: dev-toolkit
   devToolkit:defaultBranch: main
   github:owner: kin0992
+  devToolkit:npmToken:
+    secure: AAABAJBpCXqVz2KYKQtgTPB4oEUkgDOLc1AhEHGhogxUi8vnCc6VjyIyIR0ilZhWdozxWL2eByCJ+w8dW9o/YyJ8o2j/XADZ

infra/index.ts

@@ -3,6 +3,9 @@ import * as github from '@pulumi/github';
 
 const cfg = new pulumi.Config('devToolkit');
 const repoName = cfg.get('repoName') ?? 'dev-toolkit';
+// npmjs.org Automation token consumed by the release workflow to publish
+// @kin0992/* packages with provenance.
+const npmToken = cfg.requireSecret('npmToken');
 
 export const repo = new github.Repository('dev-toolkit', {
   name: repoName,
@@ -22,8 +25,6 @@ export const repo = new github.Repository('dev-toolkit', {
   squashMergeCommitMessage: 'PR_BODY',
   vulnerabilityAlerts: true,
   allowUpdateBranch: true,
-  mergeCommitTitle: 'PR_TITLE',
-  mergeCommitMessage: 'PR_BODY',
   topics: [
     'platform-engineering',
     'github-actions',
@@ -78,6 +79,12 @@ new github.RepositoryDependabotSecurityUpdates('dependabot-updates', {
   enabled: true,
 });
 
+new github.ActionsSecret('npm-token', {
+  repository: repo.name,
+  secretName: 'NPM_TOKEN',
+  value: npmToken,
+});
+
 // TODO: Move Private Vulnerability Reporting under Pulumi when
 // @pulumi/github exposes the resource (upstream Terraform gap).
 // Enabled out-of-band: PUT /repos/{owner}/{repo}/private-vulnerability-reporting.