fix(release): give npm the repository field, and open a PR for the formula

[arthurpanhku]

Both first-run publishing jobs failed on v0.16.0

Neither failure was reachable before a real tag existed. The release itself succeeded — binaries, Evidence Pack, provenance attestation and the GitHub Release are all published — but npm and Homebrew did not land, and mcp-registry was correctly skipped because it needs npm.

npm — E422 on provenance

npm error 422 Unprocessable Entity — Error verifying sigstore provenance bundle:
Failed to validate repository information: package.json: "repository.url" is "",
expected to match "https://github.com/arthurpanhku/dvalincode" from provenance

package.json had no repository field at all. --provenance verifies it against the build source, so the upload was rejected after the signature had already been written to the transparency log. Added the field.

The No bin file found at dist/index.js warning in the same log is not related — it is printed before prepublishOnly runs. I checked the log to confirm the build did run (tsc -p tsconfig.json, then the full check), rather than assuming.

homebrew — GH006, protected branch

remote: error: GH006: Protected branch update failed for refs/heads/main.
remote: - 2 of 2 required status checks are expected.

This one is my error. In #160 I wrote that main had no protection and the push would succeed. I had queried the protection API but only read enforce_admins and required_pull_request_reviews, saw both empty, and concluded "unprotected" — without checking required_status_checks, which is what is actually set:

{ "required_status_checks": ["test", "Analyze JavaScript and TypeScript"], "strict": true }

A direct push from CI can never succeed against that. The job now commits to chore/homebrew-<tag> and opens a pull request. The formula generation itself worked on the failed run (✓ Formula/dvalincode.rb → 0.16.0); only the push was rejected.

One manual step, stated rather than hidden

GitHub does not start workflows for a pull request opened with GITHUB_TOKEN, so the formula PR's required checks stay pending until someone closes and reopens it. The generated PR body says exactly that.

Removing the step would need a PAT with admin rights (enforce_admins is false, so an admin token can bypass). That is a credential this repository does not currently have, and adding one to make a formula bump one click cheaper is a bad trade — so it is documented instead.

Testing

• The regenerated job's shell was extracted from the YAML and checked with bash -n; the PR-body printf was run standalone to confirm quoting survives the nested apostrophe and backticks.
• Workflow YAML parses; all six jobs and their needs intact.
• npm run check green, 332 tests / 50 files.

Security and AI Governance

• This change does not expand file, shell, network, model, or approval permissions.
• If it changes agent behavior, prompts, policy, providers, audit logging, or release/build security, I updated the relevant governance evidence in docs/.
• If it introduces a new model/provider/tool or new data flow, I completed docs/governance/AI-CHANGE-IMPACT-ASSESSMENT.md.

The homebrew job's permissions change from contents: write to contents: write + pull-requests: write; it can no longer write to main, only to its own branch. That is strictly narrower than what it had.

Notes

To finish the release: merge this, then move the tag onto the new commit —

git tag -f v0.16.0 <new-main-sha> && git push origin v0.16.0 --force

Moving it is safe here: 0.16.0 never reached npm, so nothing downstream consumed it. The GitHub Release will be rebuilt and its artifacts replaced.

Until this lands, npx -y dvalincode still serves 0.15.0, which has no dvalin_scan — so the awesome-mcp-servers submission stays on hold.