Provenance Attestation Drop

Legitimate @mastra releases publish via npm OIDC trusted publisher with SLSA provenance/attestations; malicious versions were published from a personal token with dist.attestations=null. The missing attestation (baseline @mastra/[email protected] OIDC vs 1.42.1 ehindero) is the primary compromise signal.