* fix(publish): honor publishConfig access
* test(publish): cover publishConfig access
* test(publish): handle invalid metadata json
* test(publish): replace verdaccio-dependent access tests with unit test
Verdaccio strips the top-level `access` field from publish payloads, so the
metadata-fetching integration tests could never pass. Replace them with a
direct unit test of the access-resolution logic in createPublishOptions.
---
Written by an agent (Claude Code, claude-opus-4-7).
---------
Co-authored-by: Zoltan Kochan <z@kochan.io>
