chore(0.83): sync 0.83.10 and backport RedBox 2.0

.ado/jobs/npm-publish.yml

@@ -1,6 +1,8 @@
 jobs:
 - job: NPMPublish
   displayName: NPM Publish
+  # Also disable direct template consumers until ADO publication is re-enabled.
+  condition: false
   pool:
     name: cxeiss-ubuntu-20-04-large
     image: cxe-ubuntu-20-04-1es-pt
@@ -34,7 +36,7 @@ jobs:
       displayName: Install npm dependencies
 
     - script: |
-        node .ado/scripts/configure-publish.mts --verbose --skip-auth
+        node .ado/scripts/configure-publish.mts --verbose
       displayName: Verify release config
 
     # Disable Nightly publishing on the main branch
@@ -52,9 +54,11 @@ jobs:
         condition: and(succeeded(), eq(variables['publish_react_native_macos'], '1'))
 
       - script: |
-          node .ado/scripts/apply-additional-tags.mjs --tags "$(additionalTags)" --token "$(npmAuthToken)"
+          node .ado/scripts/apply-additional-tags.mjs --tags "$(additionalTags)"
         displayName: Apply additional dist-tags
         condition: and(succeeded(), eq(variables['publish_react_native_macos'], '1'))
+        env:
+          NODE_AUTH_TOKEN: $(npmAuthToken)
 
     - script: |
         yarn config unset npmPublishAccess || true

.ado/publish.yml

@@ -51,5 +51,8 @@ extends:
     stages:
       - stage: NPM
         dependsOn: []
+        # GitHub Trusted Publishing owns releases. Retain the ADO publication
+        # path for explicit re-enablement after its contract/auth are reviewed.
+        condition: false
         jobs:
          - template: /.ado/jobs/npm-publish.yml@self

.ado/scripts/apply-additional-tags.mjs

@@ -5,9 +5,11 @@ import * as util from "node:util";
 
 /**
  * Apply additional dist-tags to published packages
- * Usage: node apply-additional-tags.mjs --tags <tags> --token <token>
+ * Usage: node apply-additional-tags.mjs --tags <tags>
  *        node apply-additional-tags.mjs --tags <tags> --dry-run
  * Where tags is a comma-separated list of tags (e.g., "next,v0.79-stable")
+ *
+ * Auth token is read from the NODE_AUTH_TOKEN environment variable.
  */
 
 const registry = "https://registry.npmjs.org/";
@@ -19,7 +21,6 @@ const packages = [
 /**
  * @typedef {{
  *   tags?: string;
- *   token?: string;
  *   "dry-run"?: boolean;
  * }} Options;
  */
@@ -28,14 +29,18 @@ const packages = [
  * @param {Options} options
  * @returns {number}
  */
-function main({ tags, token, "dry-run": dryRun }) {
+function main({ tags, "dry-run": dryRun }) {
   if (!tags) {
     console.log("No additional tags to apply");
     return 0;
   }
 
+  const token = process.env.NODE_AUTH_TOKEN;
+
   if (!dryRun && !token) {
-    console.error("Error: npm auth token is required (use --dry-run to preview)");
+    console.error(
+      "Error: NODE_AUTH_TOKEN is required (use --dry-run to preview)"
+    );
     return 1;
   }
 
@@ -58,17 +63,10 @@ function main({ tags, token, "dry-run": dryRun }) {
   for (const tag of tags.split(",")) {
     for (const pkg of packages) {
       console.log(`Adding dist-tag '${tag}' to ${pkg}@${version}`);
+
       const result = spawnSync(
         "npm",
-        [
-          "dist-tag",
-          "add",
-          `${pkg}@${version}`,
-          tag,
-          "--registry",
-          registry,
-          `--//registry.npmjs.org/:_authToken=${token}`,
-        ],
+        ["dist-tag", "add", `${pkg}@${version}`, tag, "--registry", registry],
         { stdio: "inherit", shell: true }
       );
 
@@ -88,9 +86,6 @@ const { values } = util.parseArgs({
     tags: {
       type: "string",
     },
-    token: {
-      type: "string",
-    },
     "dry-run": {
       type: "boolean",
       default: false,