npm provenance is attested via sigstore, which only supports GitHub-hosted
runners; Blacksmith reports as a self-hosted runner and the registry rejects
the publish with a 422. The release job is the sole documented exception to
running every job on Blacksmith.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>