ci(publish): add --provenance to npm publish commands

[Nexory]

Summary

The publish workflow grants id-token: write permission for npm Trusted Publishing (line 16) but the npm publish invocations omit the --provenance flag, so the elevated permission is held without generating any attestation.

What changed

Added --provenance to both npm publish calls in .github/workflows/publish.yml:

```diff

• run: npm publish

• run: npm publish --provenance

• run: npm publish --tag ${{ steps.release.outputs.tag }}

• run: npm publish --provenance --tag ${{ steps.release.outputs.tag }}
  ```

Impact

With this change, every published version gets a sigstore-backed provenance statement linking the package to the source commit and the GitHub Actions run that built it. Consumers who run npm install with attestation verification (npm install --foreground-scripts --strict-ssl --integrity --provenance or sigstore-aware tooling) can verify the package came from this repo.

The node version is already pinned to 22.18.0 (well above the 11.5.1 minimum required for Trusted Publishing, as the existing comment notes), so no toolchain changes are needed.

References

• npm docs: Generating provenance statements
• GitHub blog: Introducing npm package provenance

Notes

This issue was found during an audit of the across-protocol SDK ecosystem.