fix(publish-fork): derive repository.url from current repo for provenance

[dogmar]

Summary

Fixes the Publish Fork workflow, where all 10 packages fail with:

npm error code E422
Error verifying sigstore provenance bundle: Failed to validate repository information:
package.json: "repository.url" is "git+https://github.com/dogmar/pacer.git",
expected to match "https://github.com/klink-ing/pacer" from provenance

Root cause

scripts/publish-fork.mjs rewrote each package's repository.url to a hardcoded dogmar/pacer — a stale slug left over from before the repo moved to the klink-ing org. The workflow publishes with --provenance in CI, which signs a sigstore attestation derived from the GitHub OIDC token (encoding the real source repo, klink-ing/pacer). The npm registry rejects the publish unless repository.url matches the provenance repo, so dogmar/pacer != klink-ing/pacer → E422 on every package.

(The Publish Dry Run workflow stays green because --dry-run signs provenance locally but never does the registry PUT, so the mismatch is never validated.)

Change

Derive the slug from GITHUB_REPOSITORY (the Actions context) instead of hardcoding it, so it tracks the real repo and won't drift on a future rename. Falls back to the current fork slug (klink-ing/pacer) for local runs:

const repoSlug = process.env.GITHUB_REPOSITORY ?? 'klink-ing/pacer'
pkg.repository.url = `git+https://github.com/${repoSlug}.git`

Impact

All 10 packages failed in the last run, so nothing was published — no partial/duplicate-version state to clean up. The next version bump (or a manual re-run) will publish cleanly once this lands.

Test plan

• Merge and trigger a publish (via a version bump on main) → confirm packages publish without the E422 provenance error and repository.url in the published tarballs reads git+https://github.com/klink-ing/pacer.git.

---

Generated by Claude Code