[setu4993]

Summary

• scripts/publish.mjs now sets repository (git+https://github.com/salesforce/agentscript.git plus the package's directory) on every non-private workspace package before pnpm -r publish.
• With trusted publishing working (fix: upgrade npm in publish workflow so trusted publishing works #111), npm generates a provenance attestation, and the registry validates package.json repository.url against the repo in that attestation. None of the public packages declare repository, so the publish for fix: upgrade npm in publish workflow so trusted publishing works #111 failed with:

  E422 Unprocessable Entity - PUT .../@sf-agentscript%2fagentforce-dialect - Error verifying sigstore provenance bundle: Failed to validate repository information: package.json: "repository.url" is "", expected to match "https://github.com/salesforce/agentscript" from provenance

• Injected at publish time, next to the existing @agentscript → @sf-agentscript rewrite, so the internal → open source sync can't drop it. It also adds the repo link to the published packages on npmjs.com.

Test plan

• node --check scripts/publish.mjs
• Read-only run of the new loop against the workspace: 15 public packages, correct directory for each; private docs, ui, vscode and the root are skipped
• After merge, the Publish run on main publishes the pending versions (e.g. agentforce-dialect@2.88.3) without E422
• No E404 on other packages (would mean that package is missing its trusted publisher config)