[patcGM]

Fix

• normalize npm CLI 11.18.0 granular token metadata into the existing secret-free credential shape
• derive readonly from package permissions and automation from the granular bypass_2fa flag
• continue discarding full token values, partial keys, scopes, and raw permission payloads
• preserve legacy token-list compatibility

Live evidence

• reproduced against a real seven-day granular token on the disposable test2gm account
• normalized live output contains only ID, name, timestamps, booleans, and CIDR metadata

Verification

• 102 tests; 76% branch coverage
• Ruff and formatting pass
• actionlint passes
• Bandit has no findings
• pip-audit reports no known vulnerabilities

The provider drill remains blocked until this fix is reviewed, merged, and main CI succeeds on the resulting exact SHA.