ci: switch publish to OIDC trusted publisher with provenance