feat(ci): package-registry provenance (#38)

## Package-registry provenance

Adds native build provenance attestation to the npm publish workflow
(`.github/workflows/publish.yml`).

### Per-ecosystem changes
- **npm (npmjs.org)**: added job-level `permissions:` block (`contents:
read` + `id-token: write`) to the `publish-npm` job, and changed `npm
publish --access public` -> `npm publish --provenance --access public`.
The job publishes to the public registry (`registry-url:
https://registry.npmjs.org`), so provenance applies.

### Notes
- This repo has **no `package.json`** (it is a Deno/ReScript project per
CLAUDE.md; deps via `deno.json`). The existing `publish.yml` nonetheless
runs `npm ci` / `npm publish`. Because there is no `package.json`, there
is **no `repository` field** present for npm provenance to reference —
npm requires a `repository` field that matches the GitHub repo for
`--provenance` to succeed at publish time. This was **not fixed** here
(additive provenance change only); flagging for owner attention.
- Top-level `permissions: contents: read` already existed at file head;
the job-level block is additive and scoped to the publish job.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: hyperpolymath

.github/workflows/publish.yml

@@ -12,6 +12,9 @@ jobs:
   publish-npm:
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
@@ -32,6 +35,6 @@ jobs:
         run: npm run build
 
       - name: Publish to npm
-        run: npm publish --access public
+        run: npm publish --provenance --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}