npm: Ensure install downloads releases from the publisher repo

Ignore GITHUB_REPOSITORY when building the default release URL so npm installs
always target the published shared-context-engineering releases. Keep
SCE_NPM_RELEASE_BASE_URL as the only environment override and update the test to
cover caller-repo execution.

Co-authored-by: SCE <sce@crocoder.dev>

Author: davidabram

npm/lib/install.js

@@ -97,13 +97,13 @@ function readPackageVersion() {
 }
 
 function getRepositorySlug() {
-	return process.env.GITHUB_REPOSITORY ?? DEFAULT_REPOSITORY_SLUG;
+	return DEFAULT_REPOSITORY_SLUG;
 }
 
 export function getReleaseBaseUrl(version) {
 	return (
 		process.env.SCE_NPM_RELEASE_BASE_URL ??
-		`https://github.com/${getRepositorySlug()}/releases/download/v${version}`
+		`https://github.com/${DEFAULT_REPOSITORY_SLUG}/releases/download/v${version}`
 	);
 }
 

npm/test/install.test.js

@@ -50,12 +50,12 @@ afterEach(() => {
 });
 
 describe("release manifest verification primitives", () => {
-	test("builds the default release base URL from the repository slug", () => {
+	test("builds the default release base URL from the publisher repository slug", () => {
 		const originalRepository = process.env.GITHUB_REPOSITORY;
 		const originalReleaseBaseUrl = process.env.SCE_NPM_RELEASE_BASE_URL;
 
 		delete process.env.SCE_NPM_RELEASE_BASE_URL;
-		process.env.GITHUB_REPOSITORY = "crocoder-dev/shared-context-engineering";
+		process.env.GITHUB_REPOSITORY = "someone-else/caller-repo";
 
 		try {
 			expect(getReleaseBaseUrl("0.1.0")).toBe(