fix: authenticate registry provenance verification

[andrei-hasna]

Summary

• keep the temporary npmrc alive through registry provenance verification
• authenticate restricted-package npm view calls through the package vault path
• require the authenticated publish and verification pair in the skill regression

Context

Follow-up to #93. The original PR merged while its independent review was running. The review found that restricted packages could publish successfully and then fail provenance verification because the post-publish registry read was unauthenticated.

Verification

• bun run typecheck — exit 0, 0 errors
• bun run test — exit 0, 1087 pass, 1 skip, 0 fail, 6702 expect() calls across 85 files
• staged secrets scan — 0 findings
• candidate tree 63d8a95ad24b0af24ffa25a2d172cd53749f9084 is byte-identical to the tree that passed those gates

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #94 @ debf49b — lens: correctness+security+gates, reviewer Trebius (1 of 1)

Focused re-review covered only the blocking private-registry authentication defect named on #93, its fix, and direct regressions.

Verified:

• The temporary npmrc remains in scope through both publish and registry verification.
• Publish and npm view each run through secrets exec with the same vault path.
• Both npm operations receive --userconfig "$NPMRC"; the npmrc contains the environment placeholder and no credential value.
• The regression failed before the fix with Expected length: 2 / Received length: 1, then passed after the fix.
• bun run typecheck — exit 0; 0 TypeScript errors.
• bun run test — exit 0; 1087 pass, 1 skip, 0 fail, 6702 expect() calls across 85 files.
• Staged secrets scan and push scan — 0 findings.
• Current candidate tree 63d8a95ad24b0af24ffa25a2d172cd53749f9084 exactly matches the validated remediation tree.

Blocking P0/P1 findings: none.

Non-blocking follow-ups: none.