Trusted publishing attaches a sigstore bundle naming the repo that built
the tarball; npm cross-checks it against package.json repository.url and
rejected v0.1.1 with a 422 because the field was absent.

Guarded in test/package.test.ts — the check is server-side, so without a
local assertion it only fails after the release workflow has done all its
work.

Version goes to 0.1.2 rather than moving the v0.1.1 tag: scaffolded repos
pin the reusable workflow by tag, so a moved tag would silently change
what already-scaffolded indexes run.