pnpm publish does not pass through OIDC credentials, causing E404 on
npm. Switch to pnpm pack + npm publish per package, matching the
pattern used in wterm.
Replace NPM_VERCEL_TOKEN_ELEVATED secret with GitHub Actions OIDC
provenance. Adds `id-token: write` permission, `environment: Release`,
and `--provenance` flag. Merges build+publish into a single job.