fix: remove provenance=true from .npmrc — breaks local publish

provenance=true in .npmrc causes 'Automatic provenance generation not
supported for provider: null' on any local npm publish because there is
no OIDC provider outside of GitHub Actions. Provenance is generated
automatically by npm when publishing via OIDC Trusted Publishing from CI.

Author: SPCFXDA

.npmrc

@@ -2,8 +2,8 @@
 # The scope is owned by the cfxdevkit npm organization.
 @cfxdevkit:registry=https://registry.npmjs.org/
 
-# Provenance attestations are generated automatically by npm when publishing
-# via OIDC Trusted Publishing (no --provenance flag needed).
-# This line is a fallback for manual local publishes only.
+# NOTE: do NOT set provenance=true here.
+# When publishing via OIDC Trusted Publishing from GitHub Actions, npm generates
+# provenance automatically — no flag needed.
+# Setting it here breaks manual `npm publish` (local machine has no OIDC provider).
 # See: https://docs.npmjs.com/trusted-publishers
-provenance=true