Opt-in dist-tag permissions for npm trusted publishing

Automated excerpt

Previously, trusted publishing covered publishing and staging, but not dist-tag operations. Each trusted publishing configuration now has an opt-in Allow npm dist-tag permission. Existing token-based dist-tag management continues to work unchanged.

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.