Re-enable npm publish in the release workflow for the first public release

[AKogut]

Context

Publishing was gated off in the release workflow after an incident during M0 closeout: with zero pending changesets, changesets/action falls through to changeset publish and attempted to push empty 0.0.0 scaffolds to npm. Provenance verification rejected them (missing repository fields at the time), which was the only thing that prevented junk packages going live. The repository/license/author metadata is now in place; publish stays off until there is something real to release.

Scope

• Re-add publish: pnpm changeset publish to changesets/action in .github/workflows/release.yml
• Restore NPM_TOKEN and NPM_CONFIG_PROVENANCE: 'true' env and id-token: write permission
• Confirm repository.url matches the repo in every public package (provenance requirement)
• Ship the first changesets (reporter + sdk + contracts at minimum) and verify the version PR → publish flow end to end
• Verify packages appear on npm with provenance badges

Acceptance criteria

• Merging a version PR publishes only intentionally-versioned packages, with provenance, and the workflow is green