fix: add ./peer/supabase-js to jsr.json exports

[mandarini]

Two fixes to unblock JSR publishing and improve the JSR score.

jsr.json — ./peer/supabase-js was present in package.json exports but missing from jsr.json, so the entrypoint was invisible to the JSR registry. Added it to keep both export maps in sync.

release.yml — JSR has been silently failing to publish since v1.0.0. PR #62 split the release workflow into two jobs to isolate npm's OIDC token from the pnpm install step (supply chain hardening after the TanStack/router incident). As part of that split, id-token: write was removed from the build job on the assumption that JSR uses a separate OIDC binding that does not require it. That assumption was wrong: JSR authenticates CI publishes via Authorization: githuboidc <token>, and the JSR CLI obtains that token from GitHub's OIDC endpoint — which GitHub only exposes when the job has id-token: write. The audience is JSR-scoped (not npm), so restoring id-token: write to the build job does not re-open the npm supply chain path. The publish-npm job remains isolated with no pnpm install. Also removes continue-on-error: true from the JSR publish step so future failures are visible.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@supabase/server@94

commit: d405acb