fix(ci): add NPM_CONFIG_PROVENANCE for OIDC trusted publishing

Without this env var, pnpm doesn't initiate the OIDC token exchange
and falls back to NODE_AUTH_TOKEN which isn't set.

Author: Narrator

.github/workflows/publish.yml

@@ -56,6 +56,8 @@ jobs:
 
       - name: Publish to npm
         run: npx nx release publish --yes
+        env:
+          NPM_CONFIG_PROVENANCE: true
 
       - name: Build Gemini extension archive
         run: |