fix: add repository field for npm trusted publishing

[konard]

Summary

Fixes the npm trusted publishing E422 error by adding the missing repository field to package.json.

Root Cause

npm's trusted publishing (OIDC) performs server-side validation to ensure repository.url in package.json matches the Source Repository URI in the provenance signing certificate. Without this field, npm returns:

E422 422 Unprocessable Entity - Error verifying sigstore provenance bundle:
Failed to validate repository information: package.json: "repository.url" is "",
expected to match "https://github.com/link-foundation/lino-arguments" from provenance

Solution

Added the repository field to package.json:

"repository": {
  "type": "git",
  "url": "https://github.com/link-foundation/lino-arguments.git"
}

Case Study

A comprehensive case study documenting the timeline, error analysis, and solution has been added to docs/case-studies/trusted-publishing-failure-case-study.md.

The case study includes:

• Timeline of events
• Error analysis with exact error messages
• Root cause analysis
• References to npm documentation and related issues
• CI logs from failing runs

References

• npm Trusted Publishers
• npm Generating Provenance
• npm CLI Issue #8036

Fixes #10

Test Plan

• Local CI checks pass (lint, format, tests)
• CI pipeline passes
• npm publish succeeds after merge with provenance

🤖 Generated with Claude Code

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Public pricing estimate: $6.140544 USD
• Calculated by Anthropic: $3.949170 USD
• Difference: $-2.191374 (-35.69%)
  📎 Log file uploaded as GitHub Gist (876KB)
  🔗 View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.