fix(release): declare the repository for npm provenance

[rendis]

The first automated publish of the Studio 0.2.0 packages (run #1) was rejected by npm:

npm error 422 Unprocessable Entity - PUT https://registry.npmjs.org/@rendis%2fstatepro-studio-react
Error verifying sigstore provenance bundle: Failed to validate repository information:
package.json: "repository.url" is "", expected to match "https://github.com/rendis/statepro" from provenance

Trusted Publishing itself worked: npm accepted the workflow identity and signed the provenance. Verification then failed because neither package declares repository. Nothing was published; npm still shows 0.1.2 and 0.1.1.

Changes

• Both Studio package.json files now declare repository:
  • url: https://github.com/rendis/statepro
  • directory: the package's path in the repo
• Before packing, the release workflow sets the same field on its runner copy, using GITHUB_REPOSITORY. This is needed because the npm job publishes what is tagged, and the v3.4.0 tag predates the field. The tag can still be published without cutting a new release.

Validation

• I reproduced the tag state locally (both package.json files without repository) and ran the workflow's pack loop with pnpm 10.11.0:
  • Both tarballs come out with the correct repository.url and directory.
  • The Web Component depends on @rendis/statepro-studio-react 0.2.0.
  • npm publish --dry-run accepts both tarballs.
• actionlint reports no issues, and pnpm install --frozen-lockfile leaves the lockfile unchanged.

After merge, the push to main reruns the release workflow. It plans target=npm again and publishes both 0.2.0 packages from v3.4.0.