Wire documented npm publish authentication controls

Problem

Pantry documentation describes --otp, --no-oidc, and --no-provenance, and PublishOptions already models OTP, OIDC selection, and provenance. The CLI does not currently register or propagate these flags.

Required contract

• --no-oidc skips the OIDC attempt and uses token authentication directly
• --no-provenance disables Sigstore provenance generation for OIDC publishing
• --otp <code> sends npm's npm-otp header on the token-authenticated publish request
• both npm:publish and publish --npm expose the same controls
• documentation uses only implemented command forms
• compile and registry tests cover the option flow and request metadata where practical

Implemented on main in bbebf33. Both npm:publish and publish --npm now expose OTP, OIDC, and provenance controls; token publishing sends the standard npm-otp header when provided. Real dry-run and CLI help checks pass. Keeping this open through release verification.

Implemented in bbebf33 and documented in 60e9a85, f445abb, and 7d088dd. Both npm publication command forms now expose and propagate --no-oidc, --no-provenance, and --otp; request metadata and option flow are covered by the registry and command tests. Released in v0.10.42 and retained in v0.10.43. Pantry CI run 29887331918 is green.

Release clarification: v0.10.42 contains the source commit, but its binary Releaser was superseded before asset publication. The first complete GitHub and npm release carrying this fix is v0.10.43, produced by successful Releaser run 29887332086.