Fix npm OIDC mirror publishing

[bigboateng]

Summary

• publish the npm initializer through trusted publishing only
• disable public provenance when exact npm archives are mirrored to Artifact Registry
• keep example CI on the version declared by its frozen fixtures
• reject long-lived registry credentials and mutable example-version discovery

Test Plan

• npm run format:check
• npm run test:release
• npm run test:selfhost
• run all 45 example fixtures with their declared Yield 0.5.0 supervisor
• git diff --check