fix: remove --provenance flag from npm publish

OIDC provenance attestation requires specific subject claims that don't
match when using workflow_call from a different workflow context.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: scolladon

.github/workflows/npm-publisher.yml

@@ -94,7 +94,7 @@ jobs:
       - name: Publish to npm
         env:
           VERSION_TAG: ${{ inputs.version-tag }}
-        run: npm publish --provenance --access public --tag "$VERSION_TAG"
+        run: npm publish --access public --tag "$VERSION_TAG"
 
   deprecate:
     if: ${{ inputs.action == 'deprecate' }}