ci: add --provenance flag for OIDC Trusted Publisher auth

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: klocus

.github/workflows/publish.yml

@@ -43,4 +43,4 @@ jobs:
         run: npm run build:bundle
 
       - name: Publish to npm (via Trusted Publisher OIDC)
-        run: npm publish --access public
+        run: npm publish --access public --provenance