Split MCP Registry publish into its own job

[christophdb]

Why

The release-v1.6.1 run failed on the MCP Registry step:

Error: failed to get token: failed to exchange OIDC token:
Post "https://registry.modelcontextprotocol.io/v0/auth/github-oidc":
dial tcp 34.61.200.254:443: i/o timeout

npm and Docker had already published successfully. Two problems came out of npm and the registry sharing one job.

The failure could not be retried. Re-running the job repeats npm publish, which npm rejects for a version that already exists — so the run dies before it ever reaches the registry again. Recovery meant running mcp-publisher by hand.

The run showed red although the release was fine. @seatable/mcp-seatable@1.6.1 was on npm with dist-tag latest, the Docker image was pushed with latest, and mcp.seatable.com deployed from it. A red release status that usually means "nothing shipped" but occasionally means "only the directory entry is missing" is how people learn to stop reading release status.

What changed

publish becomes publish-npm and publish-registry, the latter depending on the former. A registry outage is now retryable on its own, and npm is untouched by that retry.

The Patch server.json version step moves into the registry job. package.json files is ["dist","bin","README.md","LICENSE",".env.example"], so server.json never ships to npm — only the registry publish ever needed the patched version.

The OIDC login retries three times with linear backoff (20s, 40s). Worth being clear about what that does and does not buy: it covers brief blips only. The registry was still unreachable from two independent networks half an hour after the v1.6.1 failure, so no retry count would have rescued that run. The job split is what makes a real outage recoverable — the retry is a cheap addition, not the fix.

Verification

This one cannot be proven before merge: the jobs are gated on refs/tags/release-v, so they do not run on a PR. What was checked:

• YAML parses; job graph is lint-and-test → init-vars → {build-and-push, publish-npm → publish-registry}.
• The retry loop's control flow was exercised in a shell with a stubbed login — success on attempt 2 exits 0 without further attempts, three failures exit 1 and do not sleep after the final one.

First real exercise will be release-v1.6.2.

Still open

The v1.6.1 registry entry is still missing. It needs a manual mcp-publisher publish once the registry is reachable — this PR does not backfill it.