npm trusted publishing requires npm >= 11.5.1. Node 22 bundles npm 10,
which never attempts the OIDC exchange, so the publish ran
unauthenticated and the registry answered 404 on PUT. Node 24 bundles
npm 11. Provenance is generated automatically under trusted publishing,
so --provenance is no longer needed.