Publishes @next-ai-drawio/mcp-server when packages/mcp-server changes on main and the package.json version isn't on npm yet. Uses npm trusted publishing (OIDC) - no token secret, no OTP, works with the strictest 2FA setting.