fix(ci): remove npm upgrade hack from provenance workflow

[jdalton]

Node 25.8.2 (.node-version) ships npm 11.11+. The curl+tar npm upgrade step is unnecessary.

---

Note

Low Risk
Low risk: this only removes a CI workaround step and relies on the Node-provided npm during the publish workflow. Main risk is publish failures if the runner’s bundled npm lacks required trusted publishing/provenance behavior.

Overview
Removes the custom curl | tar npm self-upgrade step from the provenance.yml publish workflow, so publishing now uses the npm version bundled with the Node version from .node-version.

This simplifies the build/publish jobs and avoids mutating the global npm installation mid-workflow.

^{Reviewed by Cursor Bugbot for commit 9cd7b27. Configure here.}

[jdalton]

Folded into #1161 (SHA bump + npm hack removal combined)