chore(deps): sitekit from git tag to npm release

.github/workflows/auto-merge.yml

@@ -14,10 +14,10 @@ name: Auto-merge
 
 on:
   workflow_run:
-    workflows: ["CI"]
+    workflows: ['CI']
     types: [completed]
   schedule:
-    - cron: "*/10 * * * *"
+    - cron: '*/10 * * * *'
   workflow_dispatch: {}
 
 # Declared on the CALLER as well as inside the reusable workflow: a called
@@ -36,4 +36,4 @@ jobs:
       base_branch: main
       ci_workflow: ci.yml
       # SPACE-separated: the sweep word-splits this.
-      rearm_workflows: "ci.yml publish.yml"
+      rearm_workflows: 'ci.yml publish.yml'

package.json

@@ -21,7 +21,7 @@
     "next": "16.3.4",
     "react": "19.2.8",
     "react-dom": "19.2.8",
-    "sitekit": "github:bitbaum/sitekit#v0.3.0"
+    "sitekit": "npm:@bitbaum/sitekit@^0.3.0"
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4",

pnpm-workspace.yaml

@@ -1,6 +1,10 @@
 # pnpm 11 blocks dependency build scripts by default; allow only what we trust.
 allowBuilds:
-  'sitekit@https://codeload.github.com/bitbaum/sitekit/tar.gz/9122b6b6c62a35aeefcb5508d1da9914b0435367': true
   esbuild: true
   sharp: true
   unrs-resolver: true
+
+# Own package published to npm <24h ago; exempt from the minimum-release-age
+# supply-chain window. Redundant once the release ages past the window.
+minimumReleaseAgeExclude:
+  - '@bitbaum/sitekit'