fix: add --provenance flag to npm publish for OIDC auth

Without --provenance, npm doesn't use the GitHub OIDC token
and falls back to expecting traditional auth credentials.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: tianzhou

.github/workflows/publish.yml

@@ -154,4 +154,4 @@ jobs:
             package.json > package.json.tmp
           mv package.json.tmp package.json
 
-          npm publish --access public --tag "$TAG"
+          npm publish --access public --tag "$TAG" --provenance