I finally figured this out with a help of a colleague! I just had to create a user that I can use for authentication in publish operation. AFAICS now everything works as expected.

The difference in authentication of zpm-registry's /package and /packages paths confused me untiI I read the source code.

Essentially my problem here was this was the first time I run into these web applications and IRIS authentication model.