Replace JWT claim system with npm maintainer email matching and provenance metadata

- Remove ApplicationNpmClaimService, NpmClaimTokenDTO, NPM_CLAIM JWT type,
  and all claim-related mutations/methods across server, SDK, and frontend
- Add provenanceRepositoryUrl, isProvenanceVerified, provenanceVerifiedAt
  fields to ApplicationRegistrationEntity with core migration
- Create ApplicationNpmRegistrationService with email-based ownership
  verification and lightweight npm provenance attestation fetching
- Add registerNpmPackage GraphQL mutation with workspace auth guards
- Enforce twenty-app- prefix for all npm package names in validation
  and marketplace search filtering
- Create .github/actions/publish-twenty-app composite action for
  building and publishing apps with --provenance
- Scaffold publish.yml GitHub workflow in create-twenty-app
- Add app:register CLI command and public operation in SDK
- Update frontend empty state to show app:register instructions
- Enrich MarketplaceCatalogSyncService to fetch and store provenance
  metadata during npm app discovery
- Add unit tests for registration service and package name validation

Made-with: Cursor

.github/actions/publish-twenty-app/action.yaml

@@ -0,0 +1,37 @@
+name: Publish Twenty App
+description: Build and publish a Twenty app to npm with provenance
+
+inputs:
+  npm-token:
+    description: npm token with publish permissions
+    required: true
+  npm-tag:
+    description: npm dist-tag
+    required: false
+    default: latest
+  app-path:
+    description: Path to the app directory
+    required: false
+    default: '.'
+
+runs:
+  using: composite
+  steps:
+    - uses: actions/setup-node@v4
+      with:
+        node-version: '24'
+        registry-url: https://registry.npmjs.org
+
+    - name: Install and build
+      shell: bash
+      working-directory: ${{ inputs.app-path }}
+      run: |
+        yarn install --immutable
+        npx twenty app:build
+
+    - name: Publish with provenance
+      shell: bash
+      working-directory: ${{ inputs.app-path }}/.twenty/output
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.npm-token }}
+      run: npm publish --provenance --access public --tag ${{ inputs.npm-tag }}