chore: drop provenance from publishConfig for local publishes

Set when the workflow was still tag-driven; without an OIDC provider in
the publish environment, npm refuses with "Automatic provenance
generation not supported for provider: null". Local publishes can't sign
provenance attestations, so the flag has to go.

Author: yigithanyucedag

package.json

@@ -80,7 +80,6 @@
     "node": ">=20"
   },
   "publishConfig": {
-    "access": "public",
-    "provenance": true
+    "access": "public"
   }
 }