fix(ci): add package repository metadata for npm provenance