Add npm provenance publish workflow

[jozefizso]

Summary

• update the publish workflow to Node.js 24 on macos-15-intel
• pack the npm tarball before publishing and attest that exact artifact with GitHub artifact attestations
• publish to npm with provenance enabled and public scoped package access

Verification

• ruby YAML parse for publish workflow
• HFS test volume + ROOT_VOLUME=/Volumes/macos_alias npm test
• npm audit --audit-level=moderate
• npm ls --omit=dev --all
• npm pack --dry-run