fix: remove --provenance from npm publish

Bun does not support provenance attestation, and the mixed bun/npm
setup with --provenance was causing 404 errors on publish. Removing
provenance unblocks publishing; it can be re-added if the project
migrates fully to npm or if bun adds provenance support.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: teallarson

.github/workflows/release.yml

@@ -7,7 +7,7 @@ on:
 
 permissions:
   contents: write
-  id-token: write
+
 
 jobs:
   release:
@@ -44,7 +44,7 @@ jobs:
 
       - name: Publish to npm
         if: steps.version.outputs.changed == 'true'
-        run: npm publish --access public --provenance
+        run: npm publish --access public
 
       - name: Create GitHub Release
         if: steps.version.outputs.changed == 'true'