npm's provenance check refuses the publish with E422: the tarball is built
from XDTrees/dsh-xdpool (the repo was renamed), but package.json still
declared the pre-rename repository URL, and provenance requires the two to
match. The URLs now point at the new name - GitHub redirects the old one, so
every link a user already has keeps working.