Let the agent cut the release, keep the approve button for yourself: npm staged publishing from Actions
npm stage publish lets CI upload a version without 2FA and holds it until a maintainer approves. About twenty minutes to set up, and it fits agent-driven release PRs well.
8 min read