chore(ci): bump provenance.yml registry SHA + rename publish-script

Two changes to the provenance delegator:

1. Bump `SocketDev/socket-registry/.github/workflows/provenance.yml`
   pin from 34fef52be9 to d54c36d0. Was the last stale fleet pin
   (socket-lib also just caught up; socket-sdk-js is on this SHA
   via PR #596; the rest of the fleet moved months ago).

2. Rename `publish-script: publish:ci` → `release:ci` to match the
   in-repo script rename (part of the broader rename to match the
   repo's `pnpm release` vocabulary).

No behavioral change — both are metadata-level consistency fixes.

Author: jdalton

.github/workflows/provenance.yml

@@ -32,12 +32,12 @@ permissions:
 
 jobs:
   publish:
-    uses: SocketDev/socket-registry/.github/workflows/provenance.yml@34fef52be917f89dbbeb464860f2aaf0f3812c40 # main
+    uses: SocketDev/socket-registry/.github/workflows/provenance.yml@d54c36d0bed05ffffbe8b14e7663927eaa19d5df # main
     with:
       debug: ${{ inputs.debug }}
       dist-tag: ${{ inputs.dist-tag }}
       package-name: '@socketregistry/packageurl-js'
-      publish-script: 'publish:ci'
+      publish-script: 'release:ci'
       publish-without-sfw: ${{ inputs.publish-without-sfw }}
       setup-script: 'ci:validate'
       use-trusted-publishing: true