feat(HAI-110): enable npm provenance attestation in version workflow

- Add --provenance flag to pnpm publish command in version workflow
- Add explanatory comment for id-token write permission
- Add test verifying id-token write permission for provenance
- Add test verifying --provenance flag is present in publish step

.github/workflows/version.yml

@@ -18,7 +18,7 @@ on:
 permissions:
   contents: write
   pull-requests: write
-  id-token: write
+  id-token: write # Required for npm provenance attestation
 
 jobs:
   release:
@@ -49,7 +49,7 @@ jobs:
         uses: changesets/action@v1
         with:
           version: pnpm release:version
-          publish: pnpm -r publish
+          publish: pnpm -r publish --provenance
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}