fix(release): add repository (fixes provenance E422) + normalize bin path

The v1.0.0 publish failed with E422: Sigstore provenance verification requires package.json repository.url to match the GitHub repo, but packages/cli had no repository field. Added repository (git+https://github.com/mcp-tool-shop-org/loadout-os.git) + homepage + bugs. Also normalized bin './dist/loadout-os.js' -> 'dist/loadout-os.js' so npm's bin normalizer stops stripping it (npm 11.x removed the bin entirely). Verified in the packed tarball: bin survives, repository present, no publish warns. Nothing was published at 1.0.0 (PUT aborted), so re-tagging v1.0.0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mcp-tool-shop

packages/cli/package.json

@@ -5,8 +5,14 @@
   "license": "MIT",
   "author": "mcp-tool-shop",
   "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mcp-tool-shop-org/loadout-os.git"
+  },
+  "homepage": "https://github.com/mcp-tool-shop-org/loadout-os#readme",
+  "bugs": "https://github.com/mcp-tool-shop-org/loadout-os/issues",
   "bin": {
-    "loadout-os": "./dist/loadout-os.js"
+    "loadout-os": "dist/loadout-os.js"
   },
   "files": [
     "dist/loadout-os.js",