fix: publish npm provenance on GitHub runner

[roodboi]

Summary

• run only the publish-npm job on ubuntu-latest
• retain npm provenance instead of weakening the publish policy
• keep build and asset jobs on their existing runners

Why

v2.25.3 built and verified every binary, published all release assets, and updated Homebrew, but npm rejected the provenance bundle because Blacksmith reports a self-hosted runner. npm provenance accepts GitHub-hosted runners.

Verification

• exact workflow diff is one runner change plus explanatory comments
• bun run check
• git diff --check
• prior v2.25.3 npm bootstrap and install-script smoke tests both passed before the provenance-only publish rejection

No credentials, personal content, or machine-specific paths are included.

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[linear-code]

HACK-924

[roodboi]

@codex review exact head f3d13f9. Please verify the npm provenance runner correction, release-safety scope, and public/privacy cleanliness. This intentionally preserves --provenance and moves only publish-npm from Blacksmith self-hosted to GitHub-hosted ubuntu-latest.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: f3d13f9e03

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

🎉 This PR is included in version 2.25.4 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀