docs: correct provenance claim for current publishes

[aryasaatvik]

Summary

docs/releases.md still said current 0.1.1 tarballs were attended local publishes and had no provenance. Both public packages are 0.2.0, and npm latest for @samva/better-auth and @samva/email-sdk carries SLSA provenance (https://slsa.dev/provenance/v1).

The provenance sentence now says trusted CI publishes from 0.2.0 carry provenance, and attended local 0.1.1 tarballs do not. The rest of the release process is unchanged.

Related issue

Closes #

Checklist

• Conventional Commit title (e.g. feat(<integration>): ...)
• bun run build passes
• bun run typecheck passes
• bun run test passes
• bun run lint and bun run format:check pass
• Added or updated tests (mocking Samva API responses)
• Updated the package/example README if behavior changed

Docs-only. No package, API, or version changes. Historical ## @samva/*@0.1.1 changelog entries are untouched.

Verification: diff is docs/releases.md only. oxfmt --check docs/releases.md passed. oxlint does not lint Markdown.

  

[greptile-apps]

Confidence Score: 5/5

The documentation-only change appears safe to merge.

Summary

Updates the release documentation to distinguish current trusted CI publishes, which carry npm provenance from version 0.2.0 onward, from the historical local 0.1.1 publishes, which do not.

_{Reviews (1) · Last reviewed commit: "docs: correct provenance claim for curre..."}