fix(js): give npm provenance a repository.url to verify against

[konard]

Problem

publishToNpm has been failing on every run, including re-runs. The 2FA banner on npmjs.com is unrelated noise — the real error is at the very end of the log in run 33160102741:

npm error code E422
Error verifying sigstore provenance bundle: Failed to validate repository information:
package.json: "repository.url" is "", expected to match
"https://github.com/link-foundation/links-notation" from provenance

js/package.json carried no repository field at all. Trusted publishing (OIDC) makes npm attach a sigstore provenance attestation derived from the Actions context, and the registry then cross-checks it against repository.url in the manifest. Empty never matches, so the upload is rejected.

Why re-running never helped: it is deterministic, not a flake. The package signs fine — the log shows Provenance statement published to transparency log — it is the registry's post-verification that fails, every time.

Why it used to work: 0.13.0 and earlier were token publishes, which attach no provenance and so never consulted the field. Switching to trusted publishing exposed a long-standing gap rather than creating one. No npm account or token setting needs changing.

Fix

Added repository/bugs/homepage to js/package.json, reusing the exact shape from js-ai-driven-development-pipeline-template, which already carries it. That repo does not have this bug, so there was nothing to report upstream — the fix flows from the template to here.

Two related bugs fixed in the same step

1. The publish log shipped inside the package. The step ran npm publish 2>&1 | tee publish.log inside the package directory, so npm built the tarball with the log in it — the 0.15.0 tarball contents list a 0-byte publish.log. It now goes to $RUNNER_TEMP.
2. E422 produced no diagnostic. The failure handler only explained ENEEDAUTH|E401|E403, so this failure printed no hint at the cause. Added a provenance branch that names the mismatched repository.url.

Verification

• npm publish --dry-run --access public passes, with repository.url correct and no publish.log in the tarball.
• Workflow YAML still parses.
• 0.15.0 was never published (npm view links-notation@0.15.0 → 404), so no version bump is needed; the existing job will publish it once this lands.

🤖 Generated with Claude Code

https://claude.ai/code/session_01W35mjrg7zi5Y8TW17EWduq