Fix npm trusted publish provenance failure

[artiphishle]

What changed

• disable automatic npm provenance for the Changesets publish step
• keep OIDC trusted publishing enabled
• keep the pending package version at 0.2.0

Why

The 0.2.0 publish authenticates with npm trusted publishing but fails while creating the Sigstore transparency-log entry with TLOG_CREATE_ENTRY_ERROR (403). npm explicitly supports NPM_CONFIG_PROVENANCE=false when provenance generation must be disabled.

Expected result

After merge, the release workflow should detect unpublished @ankhorage/utility@0.2.0 and publish that exact version without creating a new changeset or version bump.