fix: CI build order and npm publish token fallback

- Build before test in both CI and release workflows
- Add NPM_TOKEN fallback for npm publish