fix(ci): add npm provenance and update npm before publishing

- Add 'Update npm' step (npm install -g npm@latest) before publish in
  both release jobs — ensures npm supports --provenance (requires npm 9+)
- Add provenance: true to all JS-DevTools/npm-publish@v3 steps so the
  OIDC token granted by id-token:write is actually used to generate SLSA
  attestations on npmjs.com

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: cs-raj

.github/workflows/release-production-core.yml

@@ -41,13 +41,17 @@ jobs:
           filename: .github/config/release.json
           prefix: release
 
+      - name: Update npm
+        run: npm install -g npm@latest
+
       - name: Publishing core (Production)
         id: publish-core
         uses: JS-DevTools/npm-publish@v3
         with:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack/package.json
           tag: latest
+          provenance: true
 
       - name: Create Core Production Release
         id: create_release

.github/workflows/release-production-platform-plugins.yml

@@ -41,13 +41,17 @@ jobs:
           filename: .github/config/release.json
           prefix: release
 
+      - name: Update npm
+        run: npm install -g npm@latest
+
       # Utilities
       - name: Publishing utilities (Production)
         uses: JS-DevTools/npm-publish@v3
         with:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-utilities/package.json
           tag: latest
+          provenance: true
 
       # Command
       - name: Publishing command (Production)
@@ -56,6 +60,7 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-command/package.json
           tag: latest
+          provenance: true
 
       # Config
       - name: Publishing config (Production)
@@ -64,6 +69,7 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-config/package.json
           tag: latest
+          provenance: true
 
       # Auth
       - name: Publishing auth (Production)
@@ -72,3 +78,4 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-auth/package.json
           tag: latest
+          provenance: true