fix: resolve npm publish E404 and JReleaser artifact issues

[Copilot]

The preliminary release was failing with E404 on npm publish for @operaton/operaton-mcp, and JReleaser would subsequently fail due to a wrong artifact path and a missing tarball.

Changes

• Remove --provenance from preliminary npm publish: The --provenance flag triggers an OIDC token exchange in npm that returns 404 for packages not yet registered as "trusted publishers" on npmjs.org ([BUG] Publishing another version with OIDC fails to find an earlier published version of a scoped package npm/cli#8678, #8730, #8976). This masked the auth error as a confusing 404 instead of a clear 401. Provenance is kept on the final release.

• Fix jreleaser.yml artifact path: npm pack on a scoped package (@operaton/operaton-mcp) strips @ and replaces / with -, producing operaton-operaton-mcp-{version}.tgz — not operaton-mcp-{version}.tgz as previously configured.

  # before
  path: '{{projectName}}-{{projectVersion}}.tgz'
  # after
  path: 'operaton-operaton-mcp-{{projectVersion}}.tgz'

• Add npm pack before each JReleaser step: JReleaser's FLAT_BINARY distribution requires the tarball to exist on disk before it can attach it to a GitHub Release. The workflow had no step creating it.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• www.npmjs.com
  • Triggering command: /usr/bin/curl curl -s REDACTED -o /dev/null -w %{http_code} (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.