chore: align npm trusted publish config

Use npm's canonical repository URL and let publishConfig drive trusted publishing so the OIDC package metadata matches registry validation.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: fan-zhang-sv

.github/workflows/version.yml

@@ -24,9 +24,10 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          registry-url: https://registry.npmjs.org
 
       - name: Publish with provenance
-        run: npm publish --access public --provenance
+        run: npm publish
 
       - name: Deprecate
         run: npm deprecate base-mcp "This package has been deprecated. See https://docs.base.org/ai-agents for the new Base AI Agents docs."

package.json

@@ -14,7 +14,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "https://github.com/base/base-mcp"
+    "url": "git+https://github.com/base/base-mcp.git"
   },
   "author": "Dan Schlabach, Tina He",
   "license": "MIT",