ci(release): publish npm packages with provenance and attest release bundles (#1296)

Every published artifact is now cryptographically verifiable as built by
this repo's Release workflow: npm publishes carry npm provenance (OIDC,
shows the Provenance badge on npmjs.com), and the GitHub Release bundles
+ SHA256SUMS get signed build attestations via
actions/attest-build-provenance, verifiable with
`gh attestation verify <file> -R colbymchenry/codegraph`.

pack-npm.sh now writes a repository field into the generated shim and
per-platform package.jsons — npm --provenance refuses to publish without
one matching the repo — and the root package.json gains the same field.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

package.json

@@ -2,6 +2,10 @@
   "name": "@colbymchenry/codegraph",
   "version": "1.4.1",
   "description": "Supercharge AI coding agents with semantic code intelligence — surgical context, fewer tool calls, faster answers. 100% local.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/colbymchenry/codegraph.git"
+  },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "bin": {