chore: repoint repository references and fix npm publish permissions

[rekmarks-consensys-1]

The repository, homepage, and bugs metadata, the changelog release links, the code owner team, and various documentation links all named a repository URL and a team that no longer resolve directly. This corrects them, and removes two CI dependencies that cannot be satisfied from here.

It also fixes a latent publishing bug found along the way. For packages that already exist on npm, action-npm-publish@v6 unsets the auth token and publishes via OIDC. Neither publish job declared a permissions block, and id-token: write is never granted by default, so the action would print "OIDC is not available", fall back to yarn pack, and exit 0 having published nothing. The action has been on v6 since #954 without an intervening release, so this path has never actually run.

Granting the token takes two edits, not one. A called workflow's jobs cannot request more than the caller grants, and an enumerated permissions block sets every unlisted scope to none — so main.yml's caller had to widen too, or the request would have been an escalation and failed at run time. actionlint does not check permission subsetting across a workflow_call, so nothing local catches this.

Only the real publish job gets the token. publish-npm-dry-run declares no environment, so it runs ahead of the npm-publish approval gate; an OIDC token there is exchangeable at npm for a publish credential, which would leave that gate conventional rather than enforced. It therefore carries an explicit contents: read block to withhold what the caller now grants. Worth pairing with pinning npm's trusted publisher to the npm-publish environment when that gets configured.

The npm scope @metamask/* is deliberately unchanged, as are the MetaMask/* reusable actions — they are public and key off github.repository — and links to genuinely separate repositories such as MetaMask/core and MetaMask/delegation-framework.

Changes

• Update repository.url in the root manifest and propagate repository, homepage, and bugs to every workspace via yarn constraints --fix; the private packages, which the constraint does not cover, are updated to match.
• Regenerate the release-link block in all 28 changelogs. Inline pull request links are left alone: those pull requests are where the links say they are.
• Delete the security code scanner. Its secrets cannot be resolved here, and analyse-code gated all-jobs-complete, so every pull request would have failed on it. This also removes a duplicate run — the workflow declared its own push/pull_request triggers alongside the workflow_call from main.yml.
• Point CODEOWNERS at a team that resolves. An unresolvable team matches nobody rather than erroring, so review was silently never requested.
• Grant id-token: write to the npm publish job and the publish-release caller in main.yml, withhold it from the pre-gate dry run, and drop the Slack notification, whose webhook and subteam are both unreachable from here.
• Repoint documentation links, and drop two references into a private repository from comments that already describe what they guard against.

Testing

yarn constraints and yarn changelog:validate are the real regression tests for the manifest and changelog rewrites — the latter regenerates every link block from repository and fails on any difference. actionlint covers the workflow edits, and main.yml's own check-workflows job runs it in CI. yarn build and the full unit suite pass; the source edits are comment-only, so those are regression checks rather than targeted ones.

The full suite failed once in packages/kernel-ui/src/App.test.tsx and passed on re-run. That file is untouched by this branch and the test passes in isolation on both main and here, so it looks like a pre-existing flake under parallel load.

🤖 Generated with Claude Code

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	73.05% 🟰 ±0%	9790 / 13401
🔵	Statements	72.9% 🟰 ±0%	9954 / 13653
🔵	Functions	73.6% 🟰 ±0%	2301 / 3126
🔵	Branches	67.27% 🟰 ±0%	4023 / 5980

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
packages/kernel-test/src/vats/endowment-fetch.ts	0% 🟰 ±0%	0% 🟰 ±0%	0% 🟰 ±0%	0% 🟰 ±0%	16-105
packages/repo-tools/src/test-utils/fetch-input.ts	100% 🟰 ±0%	100% 🟰 ±0%	100% 🟰 ±0%	100% 🟰 ±0%

Generated in workflow #4714 for commit 22b82a0 by the Vitest Coverage Report Action

[sirtimid-ci]

LGTM!