fix: staged publishing fixes, add provenance config

[theoephraim]

Summary

• Add provenance boolean to PublishConfig — attaches Sigstore provenance attestation when publishing via npm (replaces needing publishArgs: ["--provenance"])
• Fix npm staged publishing minimum version: requires npm >= 11.15.0 (was incorrectly set to 11.5.1 — npm stage was introduced in 11.15.0)
• Throw hard errors (not warnings) when provenance or npmStaged are used with a non-npm publishManager
• Throw clear error with upgrade instructions when npm version is too old for staged publishing
• Add npm install -g npm@latest step to release workflow
• Enable both provenance and npmStaged in bumpy's own config
• Patch bump to republish README with corrected docs URL

Test plan

• All 6 publish-pipeline tests pass
• Typecheck passes
• Merge → version PR → merge version PR → staged publish with provenance

[github-actions]

The changes in this PR will be included in the next version bump.

Patch releases

• @varlock/bumpy 1.9.0 → 1.9.1

Bump files in this PR

• fix-readme-url.md (view diff) (edit)

Click here if you want to add another bump file to this PR

---

This comment is maintained by bumpy.