fix: patch semantic-release for Trusted Publishers

See (Claude's) comment in pnpm-workspace.yaml for the gnarly details.

Author: eportis-cloudinary

patches/@semantic-release__npm@13.1.5.patch

@@ -0,0 +1,15 @@
+diff --git a/lib/publish.js b/lib/publish.js
+index ac3e6feea8e388d88e77d58538a265f7ab4eac05..3af1b9ff1859dfa463398d9d97fd4c26f37c270c 100644
+--- a/lib/publish.js
++++ b/lib/publish.js
+@@ -22,8 +22,8 @@ export default async function (npmrc, { npmPublish, pkgRoot }, pkg, context) {
+     logger.log(`Publishing version ${version} to npm registry on dist-tag ${distTag}`);
+     const result = execa(
+       "npm",
+-      ["publish", basePath, "--userconfig", npmrc, "--tag", distTag, "--registry", registry],
+-      { cwd, env, preferLocal: true }
++      ["publish", "--userconfig", npmrc, "--tag", distTag, "--registry", registry],
++      { cwd: basePath, env, preferLocal: true }
+     );
+     result.stdout.pipe(stdout, { end: false });
+     result.stderr.pipe(stderr, { end: false });

pnpm-lock.yaml

@@ -1,3 +1,22 @@
 packages:
-  - "docs"
-  - "next-cloudinary"
+  - docs
+  - next-cloudinary
+patchedDependencies:
+  # Works around a semantic-release/npm bug: `publish.js` runs `npm publish <pkgRoot>`
+  # with cwd left at the repo root instead of <pkgRoot>. That mismatch silently breaks
+  # npm's OIDC/trusted-publishing auto-detection (it fails closed with a plain
+  # ENEEDAUTH/"npm adduser" error, no OIDC-related message at all), which is what we hit
+  # switching this repo to Trusted Publishers.
+  #   Bug:          https://github.com/semantic-release/npm/issues/504
+  #   Unmerged fix: https://github.com/semantic-release/npm/pull/531
+  #
+  # Once a released @semantic-release/npm version includes that fix (or an equivalent
+  # one - check publish.js runs `npm publish` with `cwd` already set to the resolved
+  # pkgRoot path), do all of:
+  #   1. Bump the "@semantic-release/npm" version in package.json to that release.
+  #   2. Delete this patchedDependencies entry and patches/@semantic-release__npm@13.1.5.patch.
+  #   3. Run `pnpm install`.
+  # Step 1 without steps 2-3 will make `pnpm install` fail outright (pnpm errors if a
+  # patchedDependencies entry doesn't match an installed version) - that failure is the
+  # signal to finish the cleanup, not a sign anything else is wrong.
+  '@semantic-release/npm@13.1.5': patches/@semantic-release__npm@13.1.5.patch