Split MCP Registry publish into its own job

.github/workflows/build-and-publish.yml

@@ -127,8 +127,8 @@ jobs:
           vuln-type: "os,library"
           severity: "CRITICAL,HIGH"
 
-  # npm + MCP Registry publish — only on release tags (trusted publishing via OIDC)
-  publish:
+  # npm publish — only on release tags (trusted publishing via OIDC)
+  publish-npm:
     if: startsWith(github.ref, 'refs/tags/release-v')
     runs-on: ubuntu-latest
     needs: [lint-and-test, init-vars]
@@ -156,18 +156,51 @@ jobs:
             echo "::error::package.json version ($PKG_VERSION) does not match tag version ($TAG_VERSION)"
             exit 1
           fi
-      - name: Patch server.json version
-        run: |
-          jq --arg v "${{ needs.init-vars.outputs.version }}" \
-            '.version = $v | .packages[].version = $v' server.json > tmp.json && mv tmp.json server.json
       - name: Build
         run: npm run build
       - name: Publish to npm
         run: npm publish --provenance --access public
+
+  # MCP Registry publish — deliberately a separate job.
+  #
+  # The registry is third-party infrastructure and has gone unreachable during a
+  # release (v1.6.1: i/o timeout on the OIDC token exchange). While it shared a
+  # job with npm, that outage could not be retried: re-running the job repeats
+  # `npm publish`, which npm rejects for an already-published version, so the run
+  # died before ever reaching the registry again. Split out, this job retries on
+  # its own and a registry outage no longer marks an otherwise good release red.
+  #
+  # server.json is not in package.json `files`, so it never ships to npm and the
+  # version patch belongs here rather than in the npm job.
+  publish-registry:
+    if: startsWith(github.ref, 'refs/tags/release-v')
+    runs-on: ubuntu-latest
+    needs: [init-vars, publish-npm]
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Patch server.json version
+        run: |
+          jq --arg v "${{ needs.init-vars.outputs.version }}" \
+            '.version = $v | .packages[].version = $v' server.json > tmp.json && mv tmp.json server.json
       - name: Install mcp-publisher
         run: |
           curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_linux_amd64.tar.gz" | tar xz mcp-publisher
       - name: Authenticate to MCP Registry
-        run: ./mcp-publisher login github-oidc
+        run: |
+          for attempt in 1 2 3; do
+            if ./mcp-publisher login github-oidc; then
+              exit 0
+            fi
+            if [ "$attempt" -lt 3 ]; then
+              echo "::warning::MCP Registry auth attempt $attempt failed, retrying"
+              sleep $((attempt * 20))
+            fi
+          done
+          echo "::error::MCP Registry unreachable after 3 attempts. npm and Docker published fine; re-run this job alone once the registry is back."
+          exit 1
       - name: Publish to MCP Registry
         run: ./mcp-publisher publish