fix: add repository field required by npm provenance verification

npm's provenance check cross-references package.json's repository.url
against the GitHub Actions OIDC attestation's source repo; without it,
a provenance-attested publish is rejected with a 422.