release: re-enable hard-fail npm publish + drop redundant brew version line

NPM_TOKEN secret in the Nexstone/rift repo is now a classic Automation
token (2FA-bypass by design), so the publish-npm job can fail-loud
again rather than soft-fail. The continue-on-error guard was only
needed for v0.1.1's first manual publish.

The source-of-truth Homebrew formula (scripts/homebrew/rift.rb) drops
the `version` line — `brew audit --strict` flags it as redundant when
the URL already encodes the version. The tap repo's Formula/rift.rb
has the same fix applied at v0.1.1.

Author: Nexstone

.github/workflows/release.yml

@@ -208,12 +208,6 @@ jobs:
     name: Publish to npm
     needs: publish-pypi
     runs-on: ubuntu-latest
-    # npm requires 2FA for first publish of @nexstone/rift-cli; the CI
-    # token isn't configured for bypass. Soft-fail so the GitHub Release
-    # still publishes off PyPI. Manual publish from a developer machine
-    # with `--otp=NNNNNN` covers v0.1.x; CI will be re-enabled once a
-    # 2fa-bypass token is added to repo secrets.
-    continue-on-error: true
     if: startsWith(github.ref, 'refs/tags/v') && (github.event_name != 'workflow_dispatch' || inputs.dry_run == 'false')
     environment:
       name: npm

scripts/homebrew/rift.rb

@@ -12,7 +12,6 @@ class Rift < Formula
   homepage "https://nexstone.io"
   # ── Versioned source — bumped automatically by .github/workflows/release.yml
   url "https://github.com/Nexstone/rift/archive/refs/tags/v0.1.1.tar.gz"
-  version "0.1.1"
   sha256 "PLACEHOLDER_SHA256_AUTO_FILLED_BY_RELEASE_WORKFLOW"
   license "Apache-2.0"