fix: align published packages with provenance

[superche]

Summary

• add GitHub repository metadata required by npm provenance to every package published by the release workflow
• bump contracts to 0.1.1 and core to 0.1.2 because the previously published package bytes are immutable
• update exact workspace consumers and lockfile references
• add a regression test covering provenance repository metadata

Root cause

The protected release reached npm through Trusted Publisher, but npm rejected the MCP package with E422 because package.json repository.url did not match the GitHub provenance repository.

Validation

• npm ci --cache=/tmp/pippit-bridge-release-npm-cache
• npm run check:public-lockfile
• npm run check:plugin-version
• npm run check:plugin-contract
• npm run check (53 files, 396 tests)
• npm run check:release-artifact
• npm run check:dev-gateway
• confirmed @pippit-bridge/contracts@0.1.1, @pippit-bridge/core@0.1.2, and @pippit-bridge/mcp-server@0.3.0 are unoccupied on the official npm registry