Without the --provenance flag, npm reports ENEEDAUTH even when the
_authToken is removed from npmrc. --provenance explicitly triggers the
OIDC token exchange for both authentication and attestation.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>