ci: publish /snapshot alphas to GitHub Packages instead of npmjs

[RuudBurger]

Follow-up to #108. The /snapshot OIDC publish 404s because npm trusted publishing is bound to release-packages.yml, not snapshot.yml (npm masks the permission failure as 404 on the restricted-scope @plextv/* packages). Rather than fight npm's single-trusted-publisher limit, this points /snapshot at GitHub Packages (the plextv org registry) so alphas stay internal and never touch public npm.

What changed

• Publish target: @plextv scope → https://npm.pkg.github.com/ (via setup-node registry-url + scope, and a publishConfig.registry rewrite per package at publish time).
• Auth: a new PLEXTV_PACKAGES_TOKEN secret instead of OIDC. @plextv/* map to the plextv GitHub org, and this repo is in plexinc, so the default GITHUB_TOKEN can't publish them cross-org.
• Provenance: stripped from each publishConfig and NPM_CONFIG_PROVENANCE=false — GitHub Packages has no sigstore attestation, so the npmjs provenance would fail.
• Dropped id-token: write (no OIDC anymore).
• The three trigger gates (org member, repo write, no forks) are unchanged.

Required before this works — you need to do these:

1. Create a token with write:packages on the plextv org (classic PAT, or a GitHub App installed on plextv) and add it as the PLEXTV_PACKAGES_TOKEN repo secret here. GITHUB_TOKEN won't do it (wrong org).
2. Same default-branch caveat as before: this only takes effect once merged to main.

Consuming an alpha in the Plex client (temporary, for testing):

# .npmrc
@plextv:registry=https://npm.pkg.github.com/

Then pin each @plextv/* catalog: entry in pnpm-workspace.yaml to the published 0.0.0-<PR#>-<datetime> version and pnpm install. The client's ~/.npmrc GitHub token needs read:packages on the plextv org. Because a scope resolves from a single registry, this routes all @plextv/* to GitHub Packages while testing — fine, since the snapshot publishes every @plextv/* package at that version. Revert the .npmrc line and catalog pins when done.

Once merged and the token's in place, comment /snapshot on a react-lightning PR to get an internal alpha.