ci: drop unsupported --provenance from jsr publish

deno publish (used by jsr) rejects --provenance; use plain npx jsr publish
with id-token: write per JSR docs.

Made-with: Cursor

Author: proxymeshai

.github/workflows/publish.yml

@@ -52,7 +52,5 @@ jobs:
         run: npm publish --access public --provenance
 
       - name: Publish to JSR
-        run: |
-          # Trusted publishing should authenticate via OIDC; token is intentionally not required here.
-          npx jsr publish --provenance
+        run: npx jsr publish