fix npx binary resolution: run in workspace, not action directory

npx was running with cwd set to the action's own directory, which has
package.json with "name": "pullfrog". npm treats the local package as
satisfying the request and skips the registry fetch, then fails to find
the binary (sh: 1: pullfrog: not found). use GITHUB_WORKSPACE instead.

Made-with: Cursor

.github/workflows/publish.yml

@@ -101,7 +101,7 @@ jobs:
 
       - name: Publish to npm
         if: steps.check_tag.outputs.exists == 'false'
-        run: NODE_AUTH_TOKEN="" npm publish --provenance --access public
+        run: npm publish --provenance --access public
 
       - name: Summary
         if: always()

package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.0.196",
+  "version": "0.0.197",
   "type": "module",
   "bin": {
     "pullfrog": "dist/cli.mjs",

runCli.ts

@@ -44,7 +44,7 @@ function runNpx(context: RuntimeContext, packageSpec: string, cliArgs: string[])
       ? join(context.nodeBinDir, "npx.cmd")
       : join(context.nodeBinDir, "npx");
   execFileSync(npxPath, ["--yes", packageSpec, ...cliArgs], {
-    cwd: context.actionRoot,
+    cwd: process.env.GITHUB_WORKSPACE || context.actionRoot,
     stdio: "inherit",
     env: context.env,
   });