Publish with provenance

[dgreif]

I'd like to cut a new release, but npm has changed security quite a bit since we last published this package:

• Adding --provenance, which gives us a nice badge in npm and points back to the workflow which built the published assets
• Adding id-token: write, which is need for provenance, but also gives us the ability to publish without an access token since I've configured this package to publish from this repo/workflow

[Copilot]

Pull request overview

Updates the npm release workflow to use npm’s provenance feature and GitHub OIDC, enabling trusted publishing from this workflow without an npm access token.

Changes:

• Add GitHub Actions workflow permissions required for OIDC (id-token: write) and restrict repository access (contents: read).
• Replace token-based npm publish with npm publish --provenance.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.