fix: enable OIDC provenance for canary snapshot publish

Without NPM_CONFIG_PROVENANCE=true, npm doesn't attempt OIDC auth and
immediately fails with ENEEDAUTH. The job already has id-token: write
so the OIDC exchange will work once provenance is enabled.

Note: the trusted publisher config on npmjs.com also needs to be
updated from piotrski/agent-react-devtools to
callstackincubator/agent-react-devtools to match the repo move.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: piotrski

.github/workflows/release.yml

@@ -58,6 +58,8 @@ jobs:
 
       - name: Publish canary snapshot
         if: steps.changesets.outputs.published != 'true'
+        env:
+          NPM_CONFIG_PROVENANCE: true
         run: |
           git checkout ${{ github.sha }}
           bun install