Fix publish: resolve workspace deps then npm publish with provenance

.github/workflows/build.yml

@@ -142,16 +142,31 @@ jobs:
 
       - run: bun install
 
-      - uses: pnpm/action-setup@v4
-        with:
-          version: latest
+      - name: Resolve workspace dependencies
+        run: |
+          node -e "
+            const fs = require('fs');
+            const coreVersion = require('./packages/core/package.json').version;
+            for (const pkg of ['packages/cli', 'packages/mcp']) {
+              const path = pkg + '/package.json';
+              const json = JSON.parse(fs.readFileSync(path, 'utf8'));
+              for (const field of ['dependencies', 'devDependencies', 'peerDependencies']) {
+                if (!json[field]) continue;
+                for (const [name, version] of Object.entries(json[field])) {
+                  if (typeof version === 'string' && version.startsWith('workspace:')) {
+                    json[field][name] = '^' + coreVersion;
+                  }
+                }
+              }
+              fs.writeFileSync(path, JSON.stringify(json, null, 2) + '\n');
+              console.log('Resolved workspace deps in', path, '→ ^' + coreVersion);
+            }
+          "
 
       - name: Publish packages to npm
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_CONFIG_PROVENANCE: true
         run: |
-          echo "//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}" > .npmrc
           publish_if_new() {
             local dir=$1
             local name=$(node -p "require('./$dir/package.json').name")
@@ -159,7 +174,7 @@ jobs:
             if npm view "${name}@${version}" version 2>/dev/null; then
               echo "${name}@${version} already published, skipping"
             else
-              pnpm --dir "$dir" publish --no-git-checks --access public
+              npm publish "./$dir" --access public --provenance
             fi
           }
           publish_if_new packages/core