ci: stage the npm launcher without provenance (#11)

The v1.1.7 release run staged nothing: npm rejects provenance for
private source repositories.

```
npm error 422 Unprocessable Entity - POST https://registry.npmjs.org/-/stage/package/@runroom%2fcode-quality - Error verifying sigstore provenance bundle: Unsupported GitHub Actions source repository visibility: "private". Only public source repositories are supported when publishing with provenance.
```

Drops `--provenance` from `npm stage publish`; re-add it if the
repository becomes public. After merge, `v1.1.7` is moved to the merge
commit so the release re-runs and stages the launcher.

Author: Cenadros

.github/workflows/release.yml

@@ -88,5 +88,5 @@ jobs:
           version="$(node -p "require('./package.json').version")"
           tag=latest
           case "$version" in *-*) tag=next;; esac
-          npm stage publish --provenance --access public --tag "$tag"
+          npm stage publish --access public --tag "$tag"
         working-directory: launcher

tests/workflows/release.test.ts

@@ -93,14 +93,14 @@ describe("release publishers", () => {
     const steps = workflow().jobs.npm.steps;
     const download = steps.find((step) => step.uses?.startsWith("actions/download-artifact@"));
     const npmInstall = steps.find((step) => step.run === "npm install -g npm@11.19.0");
-    const publish = steps.find((step) => step.run?.includes("npm stage publish --provenance --access public --tag"));
+    const publish = steps.find((step) => step.run?.includes("npm stage publish --access public --tag"));
 
     expect(download?.with).toMatchObject({ name: "launcher-dist", path: "launcher/dist" });
     expect(steps.some((step) => step.run?.startsWith("pnpm"))).toBe(false);
     expect(publish?.["working-directory"]).toBe("launcher");
     expect(npmInstall?.run).toBe("npm install -g npm@11.19.0");
     const npmInstallIndex = steps.findIndex((step) => step.run === "npm install -g npm@11.19.0");
-    const publishIndex = steps.findIndex((step) => step.run?.includes("npm stage publish --provenance --access public --tag"));
+    const publishIndex = steps.findIndex((step) => step.run?.includes("npm stage publish --access public --tag"));
     expect(npmInstallIndex).toBeLessThan(publishIndex);
   });