feat(HAI-110): enable npm provenance attestation in version workflow

- Add --provenance flag to pnpm publish command in version workflow
- Add explanatory comment for id-token write permission
- Add test verifying id-token write permission for provenance
- Add test verifying --provenance flag is present in publish step

packages/cli/src/__tests__/ci-workflow.test.ts

@@ -99,6 +99,14 @@ describe("Version & Release workflow (.github/workflows/version.yml)", () => {
     expect(workflow.permissions["pull-requests"]).toBe("write");
   });
 
+  it("has id-token write permission for npm provenance", () => {
+    expect(workflow.permissions["id-token"]).toBe("write");
+  });
+
+  it("publishes with --provenance flag", () => {
+    expect(content).toContain("--provenance");
+  });
+
   it("configures npm registry-url", () => {
     const steps = workflow.jobs.release.steps;
     const nodeStep = steps.find((s: any) => s.uses?.includes("actions/setup-node"));