Re-enable npm provenance (merge after repo is public)

[nrodd]

What

Re-enables npm provenance publishing, which is currently disabled:

• adds --provenance back to the Release workflow's publish step
• adds "provenance": true back to publishConfig in package.json

⚠️ DO NOT MERGE YET

Merge this only after fullstorydev/subtext-wizard is made public.

npm rejects provenance attestations from private source repos:

npm error 422 Unprocessable Entity - Error verifying sigstore provenance bundle:
Unsupported GitHub Actions source repository visibility: "private".
Only public source repositories are supported when publishing with provenance.

Provenance was originally dropped in 059d114 for exactly this reason. It got
accidentally re-added during the security-review pass (7d50bed), which broke
the 0.1.6 publish (E422). The fix (36a5b2e) removed it again. This PR is the
deferred re-enable for when the repo goes public.

🤖 Generated with Claude Code

---

Note

Low Risk
Release-only config; risk is operational (failed publish if merged while the repo is still private), not runtime or security logic changes.

Overview
Re-enables npm provenance on publish so releases can ship Sigstore attestations once the GitHub source repo is public.

The Release workflow publish step now runs npm publish --access public --provenance (with comments noting E422 if the repo is still private). package.json adds "provenance": true under publishConfig alongside existing public access.

Do not merge until the repository is public — the same visibility check that blocked 0.1.6 will fail CI/release publishes from a private repo.

^{Reviewed by Cursor Bugbot for commit b3c64e9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b3c64e9. Configure here.}

[cursor]

Provenance blocks local npm publish

Medium Severity

Setting publishConfig.provenance to true makes every npm publish attempt Sigstore provenance, which needs a CI OIDC provider. Local publishes (including with the existing prepublishOnly script) fail with automatic provenance errors even after the GitHub repo is public. CI can use --provenance alone.

 

^{Reviewed by Cursor Bugbot for commit b3c64e9. Configure here.}