fix(ci): unblock release-please and modernize publish workflows

[dodeja]

Two defects in the release automation:

1. release-please config referenced a nonexistent extra-file — packages/mcp/package-lock.json doesn't exist (packages/mcp is a root workspace member covered by the root lockfile). A missing extra-file makes release-please's updater fail, which is the likely reason no sdk-v-*/cli-v-* release PRs were being cut automatically (0.4.0 and the CLI release had to be cut by hand). Removed the entry; the remaining four extra-files all exist.
2. actions/checkout@v4 in both publish workflows targets deprecated Node 20 runners (CI warns on every run). Bumped to v5.

Verified: all remaining extra-file paths exist on main; workflows are otherwise unchanged.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Bca2z6b3pMPb3pe911CXAP

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Greptile Summary

The PR repairs release automation by removing an extra-file target for a nonexistent package-local lockfile and upgrades checkout in both TypeScript publishing workflows.

• Removes the obsolete packages/mcp/package-lock.json release-please updater.
• Updates the SDK and CLI publish jobs from actions/checkout@v4 to actions/checkout@v5.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code defect identified.

The publish workflows retain their existing triggers, tag references, and release steps, while the release-please removal aligns its extra-file targets with the repository’s current root-lockfile workspace layout.

Important Files Changed

Filename	Overview
.github/workflows/publish_typescript_cli.yml	Upgrades the CLI publish workflow to checkout v5 without changing its release-tag checkout or publication flow.
.github/workflows/publish_typescript_sdk.yml	Upgrades the SDK publish workflow to checkout v5 without changing its release-tag checkout or publication flow.
.release-please-config.json	Removes an updater for a nonexistent MCP package-local lockfile while retaining updates for the authoritative root lockfile and package manifests.

_{Reviews (1): Last reviewed commit: "fix(ci): unblock release-please and mode..." | Re-trigger Greptile}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
api	Ready	Preview	Aug 22, 2026 7:27am

[vorflux]

Summary

Reviewed the release automation changes in .github/workflows/publish_typescript_cli.yml, .github/workflows/publish_typescript_sdk.yml, and .release-please-config.json. The workflow action updates are compatible with the configured runners, and removing the obsolete nested lockfile reference keeps release-please aligned with the repository's current workspace lockfile layout.

Verdict

✅ Reviewed — no issues found. The configuration parses successfully, the diff passes formatting checks, and no actionable correctness, security, data-loss, error-handling, compatibility, or concurrency concerns were identified.