fix: provenance-file takes precedence over OIDC auto-generated provenance

[yunseo-kim]

Why Needed

When publishing with an externally generated provenance bundle under OIDC trusted publishing
(npm publish <tarball> --provenance-file=<bundle>), npm silently discarded the supplied bundle and published
its own auto-generated provenance instead. Three layers interacted:

1. lib/utils/oidc.js auto-enabled provenance (opts.provenance = true) whenever the provenance config was at
   its default, without checking whether a provenance-file was supplied.
2. In libnpmpublish's buildMetadata(), the inner provenance === true branch then ran generateProvenance(),
   so the verifyProvenance(subject, provenanceFile) branch, the only code path that reads the supplied file,
   never executed.
3. Every documented way to disable automatic provenance was unusable in combination with --provenance-file
   (config-layer mutual exclusivity error, env carve-out, or publishConfig flatten timing).

What Changes

• lib/utils/oidc.js: skip auto-enabling provenance when a provenance file is configured (opts.provenanceFile).
  opts already carries provenanceFile from every config source (CLI/env/npmrc/publishConfig) by the time the
  OIDC flow runs, so this covers all entry paths. The supplied bundle is now verified via verifyProvenance() and
  published, as documented.
• libnpmpublish: buildMetadata() now throws EPROVENANCECONFLICT when both provenance: true and
  provenanceFile are provided.
• Docs: config descriptions for provenance / provenance-file and the libnpmpublish README now state the
  precedence rule.

⚠️ New error code (feedback requested)

This PR introduces EPROVENANCECONFLICT in libnpmpublish, thrown when both provenance: true and
provenanceFile are provided programmatically.
Rationale: the README already documents the two as mutually exclusive, and silently preferring either direction
discards a cryptographically meaningful artifact. Note the CLI's config layer reports the same conflict as a
TypeError without an error code (pre-existing). Happy to align on EUSAGE or another convention per
review.

Testing

• New CLI regression test: OIDC trusted publishing + provenance-file config asserts the published packument's
  sigstore attachment deep-equals the supplied bundle (and that sigstore generation is never invoked).
• New libnpmpublish test: both options set → rejects with EPROVENANCECONFLICT, no registry PUT,
  generation not invoked.
• Full root suite green with 100% coverage; libnpmpublish workspace suite green; lint clean.

References

Fixes #9879

Out of scope (noted for follow-up)

• publishConfig.provenance: false does not block the OIDC auto-enable (publishConfig flattens into opts only,
  so config.isDefault('provenance') stays true). A separate behavioral question about isDefault semantics.
• config.set('provenance', true, 'user') bypassing load-time exclusivity is unreachable in this flow after this fix;
  hardening config.set itself is an @npmcli/config semver-major conversation.