chore(provenance): drop publish-without-sfw escape hatch

[John-David Dalton (jdalton)]

Summary

Removes the publish-without-sfw escape hatch from the provenance workflow on v1.x. With the sfw checksum/version pin from #1252 in place and sfw-enterprise live (via SOCKET_API_TOKEN), the firewall's bypass registry kind already covers github.com, codeload, and the release-asset CDNs — so publish flows don't need to strip shims anymore.

What changed

.github/workflows/provenance.yml:

• Dropped the publish-without-sfw workflow_dispatch input.
• Dropped the Strip sfw shims for publishing step (renamed shim files to *.disabled before publish).
• Dropped the Restore sfw shims after publishing step (renamed them back).

Net: -26 lines, no behavior change for normal publishes — the escape hatch was off by default.

Why now

The escape hatch existed because earlier sfw versions blocked legitimate publish traffic. That's no longer true — bypass covers what publish needs. Mirrors socket-registry's d638c11f.

Test plan

• Next manual workflow_dispatch of "Publish to npm registry" no longer shows the publish-without-sfw checkbox.
• Publish run completes successfully (sfw stays in PATH the whole time).

---

Note

Low Risk
Low risk workflow simplification: removes an optional publishing bypass path without changing the default publish behavior. Risk is limited to cases where publishes previously relied on disabling the sfw shims to succeed.

Overview
Removes the publish-without-sfw manual input from the provenance.yml publish workflow and deletes the conditional steps that temporarily disabled and then restored sfw shim wrappers around publish.

Publishing now always runs with the sfw shims in place, eliminating the escape hatch while keeping the existing build and multi-variant npm publish steps unchanged.

^{Reviewed by Cursor Bugbot for commit 9ed63f3. Configure here.}