fix: revert provenance auth to PLUGIN_PUBLISH_TOKEN (#33)

## Summary
- Reverts provenance check auth from GitHub App token back to
`PLUGIN_PUBLISH_TOKEN` PAT
- PR #23 introduced `CARTA_CI_APP_ID` / `CARTA_CI_APP_PRIVATE_KEY`
secrets that were never added to this repo, breaking all provenance
checks since merge

## Changes Made
- Removed `actions/create-github-app-token@v1` step
- Restored `PLUGIN_PUBLISH_TOKEN` as the auth token for cross-repo API
calls
- All other provenance logic (published_content_hash, deletion handling)
preserved

## Test plan
- [ ] Provenance check passes on this PR
- [ ] Verify cross-repo access to `carta/claude-marketplace` works with
the PAT

## Related
- Fixes regression from PR #23
- Unblocks PR #32

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude <noreply@anthropic.com>

Author: vijayCarta

.github/workflows/provenance-check.yml

@@ -13,12 +13,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/create-github-app-token@v1
-        id: app-token
-        with:
-          app-id: ${{ secrets.CARTA_CI_APP_ID }}
-          private-key: ${{ secrets.CARTA_CI_APP_PRIVATE_KEY }}
-          repositories: claude-marketplace
       - name: Identify changed plugins
         id: changes
         run: |
@@ -39,7 +33,7 @@ jobs:
         if: steps.changes.outputs.changed_plugins != ''
         run: python .github/scripts/verify-provenance.py "$CHANGED_PLUGINS"
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.PLUGIN_PUBLISH_TOKEN || github.token }}
           PROVENANCE_REPO: ${{ vars.PROVENANCE_REPO }}
           CHANGED_PLUGINS: ${{ steps.changes.outputs.changed_plugins }}
       - name: Post failure comment