build(release): attach npm provenance on publish

[soufian3hm]

Closes #65.

NPM_CONFIG_PROVENANCE: true ran on the 0.2.1 publish with id-token: write on a public repo, but the tarballs carried no dist.attestations -- the env var did not survive the changesets -> pnpm publish chain.

This applies the durable fix from the issue: set "publishConfig": { "provenance": true } in both SDK packages. It is tool-agnostic (no env plumbing), so provenance attaches on the next publish regardless of how pnpm publish is invoked. The release workflow's visibility-gated NPM_CONFIG_PROVENANCE is left in place as belt and braces.

Changes

• packages/client/package.json, packages/react/package.json: add provenance: true to the existing publishConfig.
• Changeset: patch-bumps both packages so the fix reaches npm on the next release (verify dist.attestations exists afterward).

Verification

• pnpm install --frozen-lockfile, pnpm lint (biome), pnpm --filter "./packages/*" build, and typecheck + vitest for @chimely/client + @chimely/react all pass (159 tests).
• No code, API surface, or generated artifacts touched; the Rust, license, and docker CI jobs are unaffected.

[greptile-apps]

Greptile Summary

This PR enables npm provenance for the published SDK packages. The main changes are:

• Patch changeset for @chimely/client and @chimely/react.
• publishConfig.provenance: true added to packages/client/package.json.
• publishConfig.provenance: true added to packages/react/package.json.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
.changeset/attach-npm-provenance.md	Adds patch release entries for both SDK packages.
packages/client/package.json	Adds npm provenance publishing metadata for @chimely/client.
packages/react/package.json	Adds npm provenance publishing metadata for @chimely/react.

_{Reviews (1): Last reviewed commit: "build(release): attach npm provenance on..." | Re-trigger Greptile}

[that-ambuj]

@soufian3hm thanks for the contribution! please remove the changeset as it's not needed for this change.

[soufian3hm]

@that-ambuj Done ✅