Fix MCP registry OIDC audience

[autholykos]

Summary

• Upgrade the pinned MCP publisher used by release automation from v1.5.0 to v1.7.6.
• Pass the production MCP registry URL explicitly during GitHub OIDC login so the requested audience matches the registry.

Backlog / Issue

• Release follow-up for the failed v1.0.0-beta.9 MCP registry publish step.

Core Trust Surface

• Does this PR touch a core write path or authoritative-state contract? No.

Validation

• I ran make ci
• I added or updated tests where needed

Validation run:

• make fmt
• git diff --check -- .github/workflows/release.yml
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release.yml"); puts "valid yaml"'

Notes

• Go tests were not run because this is release workflow-only.

[Copilot]

Pull request overview

Updates the release automation workflow to ensure MCP registry publishing succeeds with GitHub OIDC by aligning the requested OIDC audience with the production registry.

Changes:

• Bump pinned mcp-publisher used in the release workflow from v1.5.0 to v1.7.6 (with updated SHA256).
• Pass the production MCP registry URL explicitly to mcp-publisher login github-oidc via --registry.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.