npm publish --provenance was rejected during the 11.4.3 release because the package.json had no repository field, so the sigstore provenance bundle's repository URL did not match. Add repository (with monorepo directory pointer), bugs, and homepage so verification succeeds.