ci: publish to npm with provenance

[masnwilliams]

Summary

Adds --provenance to the release.yml publish step. 0.1.0 published fine over OIDC but without a provenance attestation (provenance: false on npm); this makes future releases carry a signed build-provenance attestation tying the tarball to this repo + workflow — the same attestation @onkernel/cua packages have.

No other change. Works with the existing id-token: write + trusted publishing already in the workflow.

Effect

• npm shows the "Published via GitHub Actions" provenance badge, and npm audit signatures can verify the source.
• Takes effect on the next v* tag release; 0.1.0 (already out) is unaffected.

---

Note

Low Risk
Single CI flag on npm publish; no application, auth, or runtime behavior changes.

Overview
The release workflow’s Publish to npm step now runs npm publish with --provenance, so future tag releases emit a signed build-provenance attestation linking the tarball to this repo and GitHub Actions workflow.

This aligns @onkernel/eve-extension with packages like @onkernel/cua that already publish with provenance. Existing id-token: write and trusted publishing are unchanged; only the publish flags differ. Effect applies on the next v* release, not on already-published versions such as 0.1.0.

^{Reviewed by Cursor Bugbot for commit 7681d9a. Bugbot is set up for automated code reviews on this repo. Configure here.}