Keep GitHub releases and npm publishing aligned with package.json while making deploy.sh the single source of truth for release validation.