fix: correct npm repository URL for OIDC provenance validation

[rgarcia]

Summary

Fixes the v0.14.6 release failure. npm's OIDC provenance check requires repository.url in the published package.json to match the actual GitHub repo URL from the provenance attestation.

The error

npm error 422 Unprocessable Entity - Error verifying sigstore provenance bundle:
Failed to validate repository information: package.json: "repository.url" is
"https://github.com/kernel", expected to match "https://github.com/kernel/cli" from provenance

Fix

# Before
repository: "https://github.com/kernel"

# After
repository: "https://github.com/kernel/cli"

Test plan

• Merge and tag v0.14.7 to verify npm publish succeeds with OIDC

---

Note

Low Risk
Single-field change to release metadata; affects npm publish validation but not runtime code paths.

Overview
Fixes npm release metadata by updating the npms config in .goreleaser.yaml so the published package repository URL points to https://github.com/kernel/cli instead of the org root, aligning with OIDC/sigstore provenance expectations.

^{Written by Cursor Bugbot for commit 3eb197d. This will update automatically on new commits. Configure here.}