fix(ci): unblock npm publish under allow-directory=root

The Publish step has been failing with EALLOWDIRECTORY ("Fetching non-root
packages of type directory have been disabled") since the first release after
the dependency-safety .npmrc landed. nx-release-publish runs npm publish from
each package's dist dir, so the spec is a directory; libnpmpack passes _isRoot
to pacote.manifest() but not to the subsequent pacote.tarball() call, so pacote
treats our own package as a non-root directory fetch and refuses it. Reproduces
on npm 11.16 through 12.0.1.

Override allow-directory for the Publish step only, so installs keep the full
policy. Nothing in that step resolves dependencies, so the relaxation has no
reachable effect beyond letting npm read the dist dir it already resolved; the
published tarball is unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: andrew-polk

.github/workflows/release.yml

@@ -63,6 +63,15 @@ jobs:
       - name: Publish
         env:
           NPM_CONFIG_PROVENANCE: true
+          # Work around an npm bug: libnpmpack calls pacote.tarball() without
+          # _isRoot, so publishing a local directory (which is what
+          # nx-release-publish does, from each package's dist) trips our
+          # .npmrc allow-directory=root policy with EALLOWDIRECTORY. Still
+          # broken as of npm 12.0.1. Scoped to this step so installs keep the
+          # full policy; safe only because nothing resolves dependencies here
+          # (no npm install, and no package has a prepare/prepack script --
+          # if one is ever added, revisit this).
+          NPM_CONFIG_ALLOW_DIRECTORY: all
         shell: bash
         run: |
           set -euo pipefail