ghostpublish

ci-oidc-double-use: fix base64 line-wrap breaking node -e

oidc-double-use: bump default rounds 3 → 30 + statistical note

chore: update

fix dual-ref workflow: use granular token for auth, provenance for signing

add dual-ref provenance test and supporting scripts