X_TRUST_ENVIRONMENT_EMPTY

--environment was given as an empty string

an empty value attaches a publisher npm honours from any environment, which disables the required reviewer and the v* tag rule the npm-publish environment carries — and because the check compared '' to '', the same argument that turned the gate off also made it report configured

bun run scripts/trust-publishers.ts --environment npm-publish