the npm deploy links to npm

[hamzafer]

The "npm" entry under Deployments on the repo page now links to the version's npm page (environment.url). GitHub's Packages box only lists GitHub Packages, so this is the repo page's link to npm.

• publish-cli.yml: the job's environment gets a url built from the version the check step outputs. Same environment name, so npm's trusted publisher is unchanged.
• test/workflows.test.mjs: accepts the environment: { name: npm } form (still fails with no environment).

Merging runs the workflow once (the file changed): 0.2.1 is already on npm, so it publishes nothing and records the link.

🤖 Generated with Claude Code

[hamzafer]

Review outcomes

Sonnet review, one Codex pass (gpt-5.6-luna), one fix batch (bcf8c39) verified by a Sonnet agent and CI.

Finding	Outcome
Sonnet: the first commit had no workflow change (a local restore after a mutation test reverted it)	Fixed: the environment block with url is in the PR
Codex P2: the test accepted a sibling name: npm beside an empty environment: (job gets no environment)	Fixed: name must be nested under environment (mutation-tested)
Sonnet: the test accepted npm-test	Fixed: the name must be exactly npm (mutation-tested)
Skipped runs need a URL too	Already so: version= is written before the check
Version flows into an output and a URL	Hardened: the step fails on anything that isn't a plain semver
Flow style or url before name is rejected by the test	No change: fails safe, the real file uses block form with name first