ci: pass token explicitly and fail loudly when REGISTRY_ACCESS_TOKEN is unset

comfy-cli removed the implicit env-var lookup and the --confirm flag.
The new contract is: pass the token via --token, and gate publishing
on a clear preflight check so CI failures point straight at the
missing secret instead of a typer "No such option" message.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.github/workflows/publish.yml

@@ -48,4 +48,10 @@ jobs:
         env:
           REGISTRY_ACCESS_TOKEN: ${{ secrets.REGISTRY_ACCESS_TOKEN }}
         run: |
-          comfy --skip-prompt node publish --confirm
+          if [ -z "$REGISTRY_ACCESS_TOKEN" ]; then
+            echo "::error::REGISTRY_ACCESS_TOKEN secret is not set on this repository."
+            echo "Create a Personal Access Token at https://registry.comfy.org/ (Settings → Create new token)"
+            echo "then add it via: gh secret set REGISTRY_ACCESS_TOKEN --body '<token>'"
+            exit 1
+          fi
+          comfy --skip-prompt node publish --token "$REGISTRY_ACCESS_TOKEN"