ci: add dist-tag support for publishing from non-main branches

When releasing from branches other than main (e.g., feature branches, release candidates), the dist-tag should be set to something other than 'latest' to prevent accidental default installs.

Changes:
- Add dist-tag input to workflow (default: 'latest')
- Create publish:ci script that reads DIST_TAG env var
- Update to socket-registry provenance workflow with dist-tag support
- Pass dist-tag to reusable workflow

Usage:
- Publish from main: dist-tag='latest' (default)
- Publish from branch: dist-tag='next', 'beta', 'canary', etc.

This ensures pre-release versions don't become the default npm install.

Author: jdalton

.github/workflows/provenance.yml

@@ -3,6 +3,11 @@ name: 📦 Publish
 on:
   workflow_dispatch:
     inputs:
+      dist-tag:
+        description: 'npm dist-tag (latest, next, beta, canary, etc.)'
+        required: false
+        default: 'latest'
+        type: string
       debug:
         description: 'Enable debug output'
         required: false
@@ -18,9 +23,11 @@ permissions:
 
 jobs:
   publish:
-    uses: SocketDev/socket-registry/.github/workflows/provenance.yml@1a96ced97aaa85d61543351b90d6f463b983c46c # main
+    uses: SocketDev/socket-registry/.github/workflows/provenance.yml@c722588dc8547ea3f1094f7930ce3ca3b725ffd8 # main
     with:
       debug: ${{ inputs.debug }}
+      dist-tag: ${{ inputs.dist-tag }}
       package-name: '@socketsecurity/sdk'
+      publish-script: 'publish:ci'
       setup-script: 'pnpm run build'
       use-trusted-publishing: true

package.json

@@ -47,6 +47,7 @@
     "prepare": "husky",
     "prepublishOnly": "echo 'ERROR: Use GitHub Actions workflow for publishing' && exit 1",
     "publish": "node scripts/publish.mjs",
+    "publish:ci": "node scripts/publish.mjs --skip-checks --skip-build --tag ${DIST_TAG:-latest}",
     "claude": "node scripts/claude.mjs",
     "test": "node scripts/test.mjs",
     "type": "tsgo --noEmit -p .config/tsconfig.check.json",