fix(release): align npm trusted publisher identity

.github/workflows/release.yml

@@ -17,6 +17,7 @@ jobs:
   release:
     name: Publish npm and GitHub release
     runs-on: ubuntu-latest
+    environment: npm-release
     timeout-minutes: 20
     permissions:
       contents: write

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## 0.7.3 - Unreleased
 
+- Bound npm trusted publishing to the `npm-release` GitHub environment and restored canonical package repository metadata.
 - Reworked the README around a verified install and quickstart path, with deeper command, mapper, provider, and safety details linked to the existing docs.
 - Updated transitive Vitest dependencies.
 - Updated pnpm, formatter and linter tooling, and GitHub Actions dependencies.

docs/release-prep.md

@@ -38,6 +38,9 @@ npm pack --dry-run --json --ignore-scripts
 
 ## Manual Checks
 
+- Confirm npm Trusted Publisher is bound to GitHub repository
+  `openclaw/clawpatch`, workflow filename `release.yml`, environment
+  `npm-release`, and the `npm publish` action.
 - Confirm `CHANGELOG.md` has all user-visible, operational, or security-relevant
   changes under the next unreleased version.
 - Confirm README and docs mention any new mapper behavior, commands, or safety

package.json

@@ -3,6 +3,10 @@
   "version": "0.7.2",
   "description": "Automated code review that lands fixes.",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/openclaw/clawpatch.git"
+  },
   "bin": {
     "clawpatch": "dist/cli.js"
   },