fix(ci): verify the provenance attestation landed after publishing

[yzxcj797]

Summary

Addresses #591 — prevents the silent trust-downgrade class of failure that produced 0.1.5.

Root cause (per the analysis on the issue)

npm publish --provenance publishes cleanly without an attestation whenever the run's OIDC token doesn't satisfy npm's requirements (wrong event/ref for the token, permission hiccup, manual correction run). No error surfaces — the version simply lands with no trust evidence, and attestation-checking installers (aube trust check, pnpm trust policies) then see a downgrade versus any earlier version that had one. That's exactly the 0.1.5 shape: 0.1.0 had an attestation, 0.1.5 (published through the version-correction run) had none.

Fix

The publish job now verifies the attestation landed, instead of trusting the flag:

attestations=$(npm view "@yc-software/qm@$version" attestations --json 2>/dev/null || echo '[]')
# fail the job when empty/null

• fails loudly with an actionable message (id-token permission, republish) — the next silent downgrade becomes a red build instead of a user-facing trust error;
• runs on both branches — the fresh-publish path and the already-published keep-path — so an early-exit path can never skip the evidence check either.

Notes

• Republishing 0.1.5 itself isn't possible from a PR (immutable registry); for that release the issue's trustPolicyExclude workaround stands. This change protects every future release.
• npm view <pkg> attestations returns null for no evidence on supported npm versions; the check treats null, [], and empty as failure.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}