fix(release): declare repository in npm sub-package manifests

[upsetbit]

Why

The v0.27.7 release pipeline failed at the npm step:

npm error code E422
npm error 422 Unprocessable Entity - PUT https://registry.npmjs.org/@c3-oss%2fprosa-darwin-arm64
  - Error verifying sigstore provenance bundle: Failed to validate repository information:
    package.json: "repository.url" is "", expected to match "https://github.com/c3-oss/prosa" from provenance

--provenance (now always on under OIDC trusted publishing, #318) makes npm
compare each manifest's repository.url against the repo recorded in the
sigstore bundle. The four platform sub-packages only declared homepage, so the
very first publish was rejected. This was invisible under NPM_TOKEN because no
provenance statement was generated at all.

What changed

• repository added to all four npm/prosa-*/package.json manifests, matching
  the metapackage's existing value. The metapackage already had it and would
  have passed.
• A pre-flight assertion in scripts/publish-npm.sh, sitting next to the
  existing version-coherence check. It matters that this runs before the
  publish loop: a mismatch caught mid-loop would leave some sub-packages
  published and others not, and npm will not let you re-publish a version.
• docs/distribution/npm.md updated to describe the check.

Release state this leaves behind

v0.27.7 is currently half-shipped and this PR does not by itself finish it:

Channel	v0.27.7
GitHub Release + checksums	published (13 assets)
Homebrew casks	pushed
npm	not published — failed on the first sub-package, so nothing landed; latest is still 0.27.6
GHCR images	not pushed — the step never ran

Re-running the failed job on the existing tag will not help, since the workflow
checks out the tag and the tag predates this fix. Recovering v0.27.7 needs a
tag decision, which is left to the maintainer.

🤖 Generated with Claude Code