ci: re-enable npm provenance now that the repo is public (#35)

Closes #4.

One line: `npm publish --access public` → `npm publish --access public
--provenance`.

The flag was removed while the repo was internal, since npm provenance
requires a public repository. That's no longer true, so published
packages can carry [sigstore provenance
attestations](https://docs.npmjs.com/generating-provenance-statements)
again — npmjs.com shows a "Built and signed on GitHub Actions" badge
linking back to the workflow run that produced the tarball.

## Prerequisites, verified against the workflow

- `id-token: write` is already granted at workflow level (alongside
`contents: write`) — provenance needs it to mint the OIDC token.
- The job already runs `npm install -g npm@latest` before publishing, so
the npm version is new enough to support the flag.
- `actions/setup-node` already sets `registry-url`.

Nothing else changes. `NODE_AUTH_TOKEN` and the tag-vs-`package.json`
version check are untouched.

## Note on verification

This can only be confirmed by cutting a release — there's no way to
exercise `npm publish` from CI without publishing. The next tagged
release will either produce a package with provenance or fail loudly at
the publish step, which is the same blast radius the publish step
already has.

Complementary to #21: sigstore provenance proves who built the npm
package; Kosli attestations record what the artifact is and what
evidence backs it.

Author: dangrondahl

.github/workflows/release.yml

@@ -48,7 +48,11 @@ jobs:
         run: npm test
 
       - name: Publish to npm
-        run: npm publish --access public
+        # Auth is npm Trusted Publishing (OIDC) — that is what id-token: write above
+        # is for, not provenance. Dropping it breaks publishing entirely.
+        # Trusted publishing already generates provenance on a public repo; passing
+        # --provenance makes it fail loudly rather than silently skip if that changes.
+        run: npm publish --access public --provenance
 
       - name: Pack .mcpb bundle
         run: npm run pack:mcpb