fix(ci): publish to npm natively with --provenance

@semantic-release/npm's --userconfig flag overrides OIDC auth. Disable
npm publish in semantic-release (npmPublish: false) and publish
separately with native npm publish --provenance which handles OIDC
correctly.

Author: Mearman

.github/workflows/ci.yml

@@ -95,7 +95,18 @@ jobs:
             turbo-release-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}-
             turbo-release-${{ runner.os }}-
       - run: npx turbo run _compile _schema
+      - name: Record pre-release version
+        id: pre
+        run: echo "version=$(npm pkg get version | tr -d '\"')" >> "$GITHUB_OUTPUT"
       - run: npx semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NODE_AUTH_TOKEN: ""
+      - name: Publish to npm via OIDC
+        run: |
+          CURRENT=$(npm pkg get version | tr -d '"')
+          if [ "$CURRENT" != "${{ steps.pre.outputs.version }}" ]; then
+            echo "Publishing $CURRENT to npm..."
+            npm publish --provenance --access public
+          else
+            echo "No new version — skipping npm publish"
+          fi

release.config.mjs

@@ -35,7 +35,7 @@ export default {
         ],
       },
     }],
-    ["@semantic-release/npm", { npmPublish: true }],
+    ["@semantic-release/npm", { npmPublish: false }],
     "@semantic-release/changelog",
     ["@semantic-release/git", {
       assets: ["CHANGELOG.md", "package.json"],