npm releases lack provenance

### OpenCodeReview Version

1.11.2

### Operating System

macOS (Apple Silicon)

### Installation Method

npm (global)

### LLM Provider

Anthropic (Claude)

### Bug Description

npm package releases lack provenance, but used to have provenance and so mise fails to install

```
mise use -g npm:@alibaba-group/open-code-review
npm:@alibaba-group/open-code-review@1.11.2 resolving ◡
mise ERROR Failed to install npm:@alibaba-group/open-code-review@latest: aube install failed: failed to resolve dependencies
caused by: trust downgrade for @alibaba-group/open-code-review@1.11.2 (trustPolicy=no-downgrade): earlier published version 1.1.10 had provenance attestation but this version has no trust evidence

This is a supply-chain trust failure, not an ordinary version-resolution error. An earlier release had stronger trust evidence than the selected release. This can indicate a compromised or tampered release; it can also happen when a maintainer manually publishes, backports outside the trusted workflow, skips provenance for convenience, or uses a registry that strips metadata.

Before bypassing, inspect the package's npm release, source tag/commit, publisher identity, and tarball; compare the metadata with npmjs.org. Confirm the release is expected and nothing appears tampered with, then report inconsistent evidence to the relevant upstream owner. Package-release drift belongs with the maintainer; metadata present on npmjs.org but missing from a proxy or mirror belongs with that registry operator.

Only after review, add the narrowest affected `@` to `trust_policy_excludes` for this tool, e.g.:
"npm:@alibaba-group/open-code-review" = { version = "latest", trust_policy_excludes = ["@"] }
A bare package name exempts every version. `mise settings npm.shell_out=true` uses the npm CLI and bypasses this check entirely, so it should be a last resort.

Investigation guide and known exceptions: https://aube.jdx.dev/security#trust-policy
mise ERROR Version: 2026.8.14 macos-arm64 (2026-08-25)
mise ERROR Run with --verbose or MISE_VERBOSE=1 for more information
```

### Steps to Reproduce

n/a

### Expected Behavior

npm packages published with provenance, ie: have the green tick... see https://docs.npmjs.com/viewing-package-provenance

### Logs / Error Output

```shell

```

### Additional Context

_No response_

Inspect the npm release, source tag or commit, publisher identity, and tarball, comparing their metadata with npmjs.org. The issue does not name a repository workflow file or test; done means expected package releases provide the npm provenance indicator and no longer trigger the reported trust downgrade.

Written by the indexing model from the issue text.