fix(ci): publish with explicit --provenance to surface OIDC errors

[vibe-dex]

Summary

Recent CI publish attempts have failed with a generic `404 Not Found - PUT`. Investigation showed the npm CLI is publishing anonymously — zero OIDC/provenance/trusted-publisher traces in the log — even though the workflow declares `id-token: write` and Trusted Publishing is configured on the npm package.

Adding `--provenance` makes the OIDC handshake mandatory. The next publish either:

• ✅ Succeeds end-to-end with provenance signed (if OIDC was just being skipped opportunistically), or
• ❌ Fails fast with a precise error (e.g. `ACTIONS_ID_TOKEN_REQUEST_URL not set`) that points at the actual broken layer — repo Actions settings, org-level workflow permissions, or runner regression — instead of silently degrading to an anonymous publish that returns a misleading 404.

No-op when OIDC is working; the previous behavior was already auto-signing provenance on successful runs (cf. v1.14.0 publish log: `Signed provenance statement with source and build information from GitHub Actions`). This just makes the requirement explicit and the failure mode visible.

Test plan

• Verified the same workflow currently produces zero OIDC traces in the failing publish run.
• After merge: the Release workflow will trigger on push to main. Will publish v1.15.2 (a no-op patch that captures this CI fix) and validate the OIDC handshake end-to-end. If publish fails again, the error message itself will diagnose the next step.

Made with Cursor

---

Summary by cubic

Add --provenance to npm publish in .releaserc.json to require OIDC/Trusted Publishing. This surfaces real OIDC errors and stops silent anonymous publishes that end in 404s.

• Bug Fixes
  • Require provenance signing during release; no-op when OIDC already works.
  • When OIDC is missing, publish now fails early with a precise error instead of a generic 404 Not Found - PUT.

^{Written for commit 8d25e1d. Summary will update on new commits. Review in cubic}

[github-actions]

🎉 This PR is included in version 1.15.2 🎉

The release is available on:

• v1.15.2
• GitHub release

Your semantic-release bot 📦🚀