fix(cli): point package repository identity at first-tree-ai org

[yuezengwu]

What

Updates the npm package repository identity in apps/cli/package.json to the canonical GitHub organization after the org rename agent-team-foundation → first-tree-ai:

• homepage: https://github.com/agent-team-foundation/first-tree#readme → https://github.com/first-tree-ai/first-tree#readme
• bugs.url: https://github.com/agent-team-foundation/first-tree/issues → https://github.com/first-tree-ai/first-tree/issues
• repository.url: https://github.com/agent-team-foundation/first-tree.git → https://github.com/first-tree-ai/first-tree.git (keeps .git suffix and directory: "apps/cli")

This is the only change. Package name, version, bin, build-info.ts, lockfile, workflows, database, and all other files are untouched.

Why

npm trusted publishing requires the published package's repository.url to exactly match the GitHub repository the OIDC token is minted for. After the GitHub org rename, the npm Publish workflow's staging publish (first-tree-staging@0.5.22-staging.1199.x) failed twice with registry 404 on PUT, while install/check/build/typecheck/CLI smoke/S3 preflight all passed. The last successful publish completed before the org metadata update; the two failures came after it. Aligning the package metadata with the canonical repo first-tree-ai/first-tree restores the trusted-publishing identity check. This blocks the v0.5.21 production release, which must not be tagged until the publish pipeline is healthy again.

Verification

• pnpm install --frozen-lockfile — pass; lockfile unchanged (metadata-only edit).
• pnpm check — pass (0 errors; pre-existing lint warnings unchanged).
• pnpm typecheck — pass (turbo, all packages).

Out of scope

• No repo-wide org-name migration (docs, other packages, workflows) — reported separately if needed.
• No npm workflow rerun, no tag, no GitHub Release.

[baixiaohang]

Recommendation: approve

• Rationale: The change minimally aligns the published CLI package identity with the renamed canonical GitHub repository, directly addressing the observed trusted-publishing failure without altering release behavior elsewhere.

Risk level: A

• Path baseline: apps/cli/package.json is under apps/cli/** -> A.
• Semantic lift: none.

PR summary

• Author / repo: yuezengwu / first-tree-ai/first-tree
• Problem: After the GitHub organization rename, release operators can no longer publish the staging CLI through npm trusted publishing, blocking validation ahead of the v0.5.21 production release.
• Approach: Update the CLI package homepage, issue tracker, and repository identity to first-tree-ai/first-tree; the existing prod and staging workflow rewrites preserve these fields when they change the package name, version, and binaries.
• Impacted modules: CLI npm package metadata and the downstream prod/staging npm publishing path.

Review findings

• ✅ The failed publishing run normalized repository.url to the former organization immediately before the registry PUT returned 404, so the fix is directly tied to the observed failure.
• ✅ The diff is limited to three repository URLs, and all current CI checks—including both CLI test shards and the release smoke—pass at head df1a387f1c1d2b486b68cd0890318fb9cd08549f.
• ⚠️ apps/cli/README.md still displays links under the former organization; redirects keep them functional, so the planned repository-wide migration can address this separately.

Action taken

• Approved after explicit maintainer authorization.