Publish with npm provenance: the OIDC exchange fails silently #52

@javaabu/onu and @javaabu/onu-mcp 0.2.0 have no npm attestations. release.yml sets NPM_CONFIG_PROVENANCE for public repositories, but the publish log shows the token exchange failing and the workflow still reporting success:

[WARN] Skipped OIDC: ERR_PNPM_AUTH_TOKEN_EXCHANGE: Failed token exchange request

Both packages were then published with NPM_TOKEN.

To do

• Set up npm trusted publishing for both packages, pointing at release.yml, as CONTRIBUTING.md suggests, and remove the token afterwards.
• Check that the next release actually carries an attestation.
• Consider failing the workflow when provenance is expected but missing.

🤖 Generated with Claude Code