ci(release-provenance): set top-level DO_NOT_TRACK=1 to satisfy workflow guard

The supply-chain-hardening guard (scripts/ci-workflow.spec.mjs) added in #684
asserts every workflow sets a top-level DO_NOT_TRACK=1, but release-provenance.yml
was missed — so the 'Validate CI workflow guards' check fails on every PR. Add
the env block; guard test now passes 11/11.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: blove

.github/workflows/release-provenance.yml

@@ -7,6 +7,9 @@ on:
 permissions:
   contents: read
 
+env:
+  DO_NOT_TRACK: '1'
+
 jobs:
   build-artifacts:
     runs-on: ubuntu-latest