publish: add --provenance (npm provenance via Sigstore keyless signing) - #30522

The two `expect()` calls inside the `Bun.serve` `fetch` handler (audience + Authorization header) violate REVIEW.md's "never throw inside event callbacks": if either fails, Bun.serve swallows the throw into a 500 and the test surfaces `expect(out + err).toContain("Signed provenance statement")` / `expect(err).not.toContain("error:")` instead of the real mismatch. Suggest capturing `url.searchParams.get("audience")` and `req.headers.get("authorization")` into locals (as `fulcioReq`/`rekorReq`/`pu

This hand-rolled `fn hex()` duplicates `bun_core::fmt::hex_lower` (src/bun_core/fmt.rs:2622), which this same PR already uses in publish_command.rs (`bun_fmt::hex_lower(&integrity).to_string()`) for the identical digest→lowercase-hex purpose. `bun_sigstore` already depends on `bun_core`, so the two call sites in `rekor_create_intoto_entry` can be `bun_core::fmt::hex_lower(&sha256(...)).to_string()` and this local helper deleted. Nit — no functional difference; per REVIEW.md "grep for the in-tree