feat(token): support read-write-stage-only granular access tokens #9948

Summary

Adds a read-write-stage-only value to the packages-and-scopes-permission option for npm token create, letting the CLI create granular access tokens with a stage-only publish policy (parity with the web UI). Also adds a deprecation warning when creating a direct-publish-capable token, steering users toward the stage-only value.

Changes

• Add read-write-stage-only to the packages-and-scopes-permission config enum and update its description. orgs-permission is intentionally left unchanged (the registry only accepts read-write-stage-only for packages/scopes).


• 
  token create already forwards packages_and_scopes_permission verbatim in the POST body, so the value flows straight to the registry create-token route, which normalizes it to publish_policy: stage_only — identical to the web UI.


• Add a log.warn when creating a token with read-write package/scope permission (direct-publish-capable), pointing users to --packages-and-scopes-permission=read-write-stage-only. Stage-only, read-only, and no-access tokens do not warn; --bypass-2fa is orthogonal and does not by itself trigger the warning.


• Tests: creating a stage-only token asserts the POST body carries the value and emits no warning; read-write (with and without --bypass-2fa) emits the warning; --bypass-2fa alone does not.


• Regenerate affected tap snapshots (docs.js, workspaces/config type-description.js).