chore(npm): repoint trusted-publisher to Adobe-AEM-Sites [HOLD - cutover only]

[solaris007]

Warning

DO NOT MERGE until spacecat-shared physically moves to the Adobe-AEM-Sites org.
This change is cutover-atomic, not additive. Merging early breaks all 27
package publishes from adobe/spacecat-shared. Draft on purpose.

What

Repoints npm Trusted Publishing and provenance metadata from the adobe/ org to
Adobe-AEM-Sites for the spacecat-shared GHEC migration:

• package.json (root + 28 packages): repository.url, bugs.url, homepage
github.com/adobe/spacecat-shared -> github.com/Adobe-AEM-Sites/spacecat-shared
• scripts/setup-npm-trusted-publishers.sh: REPO -> Adobe-AEM-Sites/spacecat-shared (+ header comment)
• .github/workflows/main.yaml: fix the stale "21 published" -> "27 published" count and the org self-reference in the binding comment

The npm scope name (@adobe/spacecat-shared-*) is unchanged - only the repo location moves.

Why cutover-atomic (not additive like the terraform OIDC change)

Publishing runs with NPM_CONFIG_PROVENANCE: 'true'. npm provenance generation
cross-checks each package's repository.url against the repo the workflow actually
runs in (GITHUB_REPOSITORY); a mismatch is a hard publish failure. And npm Trusted
Publishing binds each package to a single {owner/repo, workflow, environment}. So
both the URL and the binding must flip exactly when the repo moves - there is no
dual-run form.

Cutover runbook (when spacecat-shared moves)

1. Mirror/move the repo to Adobe-AEM-Sites/spacecat-shared.
2. Merge this PR (or apply the same edits on the then-current main).
3. As adobe-bot, re-run scripts/setup-npm-trusted-publishers.sh to rebind the 27
   trusted publishers to the new org (requires 2FA; needs the npm-publish GitHub
   Environment + main-only branch policy on the destination repo).
4. First release from Adobe-AEM-Sites/spacecat-shared publishes with provenance
   against the new binding - verify one package's provenance on npm.

Related: sibling terraform OIDC PR adobe/spacecat-infrastructure#801 (additive, lands independently).
Not in scope here: the insteadOf git-auth rewrite for the private adobe/mysticat-data-service
types repo in main.yaml - couples to that repo's move, tracked separately.

Change Management

cm-assessment: v1
changeType: standard
impact: unnoticeable
risk: minor
scope: single-repo
relatedPRs: ["adobe/spacecat-infrastructure#801"]
rationale: "Repoints npm trusted-publisher + provenance metadata (package.json repository.url x29, setup script REPO, workflow comment) from adobe/ to Adobe-AEM-Sites for the spacecat-shared org move. Cutover-atomic: it lands with the repo move, not before. Worst case if the binding is wrong at cutover is a failed publish that blocks a new package version - bounded and recoverable (fix the binding, re-run release), no customer impact, no data change."
recommendations: "Hold (draft) until the repo physically moves. At cutover, re-run setup-npm-trusted-publishers.sh as adobe-bot and verify one package's provenance on npm before considering the estate cut over."
backout: "Revert the commit and re-run the setup script pointing REPO back at adobe/spacecat-shared; publishing resumes from the original org."

[MysticatBot]

Hey @solaris007,

⚠ Degraded review - no spec document was found for this change (searched the PR links, the touched repos' docs, the architecture/guidelines docs, and linked Jira). This review covers code-level quality but could not validate the change against an agreed design, so confidence is reduced. Add a spec link (PR template section 4) and re-request review for a full-confidence pass.

Verdict: Request changes - stale release runbook will mislead operators at cutover.
Complexity: HIGH - large diff (31 files); Dependencies signal.
Changes: Repoints npm Trusted Publishing metadata (repository.url, bugs.url, homepage) across 29 package.json files, the trusted-publisher setup script, and the CI workflow comment from adobe/ to Adobe-AEM-Sites for the GHEC migration (31 files).
Note: CI checks are currently failing - the Test job's semantic-release dry-run fails because repository.url points to the not-yet-existing Adobe-AEM-Sites/spacecat-shared repo. This is expected for this cutover-atomic PR and will resolve when the repo moves.

Must fix before merge

1. [Important] Stale release runbook: docs/RELEASE-RUNBOOK.md contains multiple adobe/spacecat-shared references in operator copy-paste commands (e.g. gh api repos/adobe/spacecat-shared/..., trust-binding description repo: adobe/spacecat-shared, GitHub Actions URLs). After this PR merges and the repo moves, operators following the runbook would use the wrong repo slug. Apply the same adobe/spacecat-shared to Adobe-AEM-Sites/spacecat-shared find-replace to this file.

Non-blocking (2): minor issues and suggestions

• nit: README.md links to https://github.com/adobe/spacecat-shared/blob/main/packages/... - will be stale after the move, though GitHub typically redirects transferred repos
• suggestion: Convert the PR back to draft state (gh pr ready --undo) - the body says "Draft on purpose" but the PR is currently open, risking accidental merge that would break all 27 package publishes

Out of scope, worth tracking: three additional org-scoped references will also break at cutover and are not covered by this PR's npm-trusted-publisher scope: (1) GHCR image paths in .github/workflows/project-engine-client-mock-image.yaml and user-manager-client-mock-image.yaml (ghcr.io/adobe/ to ghcr.io/adobe-aem-sites/), (2) the Renovate preset source in renovate.json5 ("local>adobe/spacecat-shared"). Consider adding these to this PR or tracking them as separate cutover items.

---

_{Skill: pr-review | Model: us.anthropic.claude-opus-4-6-v1[1m] | Duration: 6m 15s | Cost: $7.60 | Commit: 56e01eb2102d54b9c08575f5de5ecb9bd293319c
If this code review was useful, please react with 👍. Otherwise, react with 👎.}