ci: enable npm provenance attestations (#159)

Sets NPM_CONFIG_PROVENANCE=true in the release workflow. The env
var is reliable because multi-semantic-release runs npm publish from
each package subdirectory, and npm only reads .npmrc from the cwd.

Also verify: the npm token is granular (not classic) scoped to
@idempot-dev. Classic tokens are being deprecated.

Author: mroderick

.github/workflows/release.yml

@@ -46,3 +46,4 @@ jobs:
         run: NPM_CONFIG_NPMCLIENT=pnpm pnpm exec multi-semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true

.npmrc

@@ -1,2 +1,3 @@
 registry=https://registry.npmjs.org/
-workspaces-update=false
+workspaces-update=false
+provenance=true