Publish from CI with npm provenance (--provenance / OIDC trusted publisher)

From the MCP registry security assessment (its item 4). `release:publish` runs `npm publish` from a maintainer laptop, so the published tarball has only npm's registry signature — `dist.attestations` is `null`, and there is no verifiable link from the tarball back to the commit that produced it.

## Goal

Publish from CI with `npm publish --provenance` under an OIDC **trusted publisher**, so consumers get a signed provenance statement pinning the tarball to its source commit and workflow run.

## Work

- Configure the npm package's trusted-publisher / OIDC settings on npmjs.com (**maintainer action — cannot be scripted from the repo**; blocks the rest).
- Add a release workflow (or extend the existing tag-triggered one) that runs `release:prepare` then `npm publish --provenance` with `id-token: write` permission, instead of a local `npm publish`.
- Keep `release:mark-dev` running post-publish (added in #2023) so `main` still moves off the released version.
- The MCP-registry publish workflow already uses OIDC (`publish-mcp-registry.yml`) — mirror its trusted-publisher pattern.

## Notes

- Independent of #2023; the release-script changes there don't conflict.
- Verify afterward: `npm view agent-device dist.attestations` is non-null and the provenance resolves to the release commit.