fix(ci): disable npm provenance for private repository

[amondnet]

Summary

• Disable npm provenance (private repo not supported)
• Keep OIDC id-token for future public repo migration
• Use NPM_TOKEN secret for authentication

Changes

• Remove --provenance flag from npm publish
• Add NPM_CONFIG_PROVENANCE=false to explicitly disable
• Add NODE_AUTH_TOKEN from NPM_TOKEN secret

Why

npm provenance requires public source repositories. This repo is private.

Test plan

• Verify npm publish succeeds on next release
• Ensure NPM_TOKEN secret is configured in repo settings

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.74%. Comparing base (ffe9873) to head (5530993).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #46      +/-   ##
==========================================
+ Coverage   48.76%   49.74%   +0.98%     
==========================================
  Files          22       22              
  Lines        4561     4535      -26     
==========================================
+ Hits         2224     2256      +32     
+ Misses       2337     2279      -58     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.