chore(publish): add publishConfig {access:public, provenance:true}

Same shape as socket-lib + socket-tui. Pins provenance to the
package manifest so it survives any future direct publish path.

Author: jdalton

package.json

@@ -3,6 +3,10 @@
   "version": "1.4.2",
   "packageManager": "pnpm@11.0.3",
   "license": "MIT",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "description": "Socket.dev optimized package override for packageurl-js",
   "keywords": [
     "Socket.dev",