Drop the private-registry workaround: flex-fields rc.16 is on npmjs

[duguankui]

Why

flex-fields 10.0.0-rc.16 had only ever been published by workflow_dispatch in abp-modules, whose release workflow mirrors to public npmjs only on a tag push. So it existed solely on GitHub Packages, under @dignite-projects/*, and consuming it here required a fair amount of machinery: npm: aliases, an extra scope mapping, credentials in both workflows, and a repointed duplicate check.

Pushing the missing v10.0.0-rc.16 tag published all four packages to npmjs and removed the reason for all of it.

The deciding argument wasn't effort, it was blast radius: a private-only dependency means every contributor needs a read:packages credential just to yarn install, and CI on a fork PR can't have one at all — GitHub doesn't pass secrets to fork-triggered runs.

What this reverts

• The four npm: aliases in angular/package.json (both dependencies and resolutions) → plain semver ranges
• angular/.npmrc's @dignite scope mapping, and any credential in it
• Both workflows' job-level token env and authenticate steps — CI now needs no package credential at all
• check-angular-package-duplicates.mjs's target, @dignite-projects → @dignite
• release.yml's packed-verify token argument, and its published-verify back to secrets.GITHUB_TOKEN

On that last one: 0.1.0-preview.11 shows GITHUB_TOKEN reads abp-modules' packages fine, thanks to the "Manage Actions access" grant those packages carry for this repo. My earlier claim that it couldn't was wrong, and is corrected in the comments.

What's kept

verify-packed-npm-install.sh's optional token/overrides path, dormant and documented as such. That gate runs after the NuGet packages are pushed live, so it failing leaves a release half-published — worth keeping the tool for the next time a dependency is consumed before it reaches npmjs.

Test plan

• Zero credentials, empty HOME, empty yarn cache: yarn install --frozen-lockfile resolves all four packages from registry.yarnpkg.com at 10.0.0-rc.16 — the contributor-experience claim, verified rather than assumed
• yarn.lock contains no alias keys and no npm.pkg.github.com URLs
• Duplicate check — 24 packages, exactly one copy each
• check-angular-package-deps.mjs on dist/site
• yarn ng test site (29), yarn build:site, yarn build (Host)

Note on abp-modules

The v10.0.0-rc.16 release run itself ended red: all packages published fine, but its post-publish verify-npm-single-copy.mjs step failed — almost certainly npmjs propagation timing, since the same packages install cleanly now. That skipped the draft-GitHub-Release steps, so rc.16 has no draft release. Worth a re-run of that job over there.