Fix npm publish failure: add repository field to package.json

[Copilot]

npm publish was failing with 422 Unprocessable Entity because sigstore provenance validation requires package.json#repository.url to match the GitHub source repository, but the field was absent entirely.

Changes

• package.json: Added missing repository field:

  "repository": {
    "type": "git",
    "url": "https://github.com/Vestaboard/vbml.git"
  }

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.