Record npm provenance metadata

[AgentGoose32]

Refs #418

Adds npm provenance metadata capture during version sync.

Changes:

• Reuses the parsed npm dist hash while mapping version metadata
• Records provenance-related fields under metadata["provenance"] when present:
  • dist.attestations
  • dist.provenance
  • dist.signatures
  • dist.npm-signature
• Keeps existing metadata["dist"] storage intact

Validation:

• ruby -c app/models/ecosystem/npm.rb
• git diff --check

Notes:

• Full Rails test execution remains locally blocked by the repo lockfile requiring Bundler 4.0.10 under system Ruby.