Wire documented npm publish authentication controls

Problem

Pantry documentation describes --otp, --no-oidc, and --no-provenance, and PublishOptions already models OTP, OIDC selection, and provenance. The CLI does not currently register or propagate these flags.

Required contract

• --no-oidc skips the OIDC attempt and uses token authentication directly
• --no-provenance disables Sigstore provenance generation for OIDC publishing
• --otp <code> sends npm's npm-otp header on the token-authenticated publish request
• both npm:publish and publish --npm expose the same controls
• documentation uses only implemented command forms
• compile and registry tests cover the option flow and request metadata where practical