Package-registry provenance

Adds native build provenance attestation to the npm publish workflow (.github/workflows/publish.yml).

Per-ecosystem changes

• npm (npmjs.org): added job-level permissions: block (contents: read + id-token: write) to the publish-npm job, and changed npm publish --access public -> npm publish --provenance --access public. The job publishes to the public registry (registry-url: https://registry.npmjs.org), so provenance applies.

Notes

• This repo has no package.json (it is a Deno/ReScript project per CLAUDE.md; deps via deno.json). The existing publish.yml nonetheless runs npm ci / npm publish. Because there is no package.json, there is no repository field present for npm provenance to reference — npm requires a repository field that matches the GitHub repo for --provenance to succeed at publish time. This was not fixed here (additive provenance change only); flagging for owner attention.
• Top-level permissions: contents: read already existed at file head; the job-level block is additive and scoped to the publish job.

🤖 Generated with Claude Code