chore: add npm provenance to publishing (#2321)

Author: bmish

.github/workflows/publish.yml

@@ -41,6 +41,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+      id-token: write
 
     steps:
       - uses: actions/checkout@v5
@@ -51,7 +52,7 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
       - uses: pnpm/action-setup@v4
       - run: pnpm install --frozen-lockfile
-      - name: npm publish
+      - name: npm publish --provenance
         run: pnpm release-plan publish
         env:
           GITHUB_AUTH: ${{ secrets.GITHUB_TOKEN }}