docs: record v0.4.115 release outcome and the mcp-publisher pitfall

- LOG.md: the CI release worked first try (green in 34s, SLSA v1 attestation
  binding the tarball to release.yml @ refs/tags/v0.4.115). Also records why
  mcp-publisher failed: the local binary was 1.5.0 from 6 March and the
  device-auth flow changed by 1.8.0 — neither error message said so
- CLAUDE.md: step 10 now tells you to check the publisher version when login
  fails with incorrect_device_code

Open follow-ups tracked in tasks/todo.md (gitignored, local only).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: aborruso

CLAUDE.md

@@ -468,7 +468,7 @@ When releasing a new version:
 7. **Build skill**: `npm run pack:skill` → produces `tmp/ckan-mcp.skill`
 8. **Attach to release**: `gh release upload v0.x.0 ckan-mcp-server.dxt tmp/ckan-mcp.skill`
 9. **npm publish happens automatically**: pushing the tag in step 5 starts `.github/workflows/release.yml`, which verifies the tag matches `package.json`, builds, tests, and runs `npm publish --provenance`. **Do not run `npm publish` by hand** — the two paths collide and the loser gets `EPUBLISHCONFLICT`. Watch the run: `gh run watch $(gh run list --workflow=release.yml --limit 1 --json databaseId -q '.[0].databaseId')`
-10. **Publish to the MCP Registry** — only **after** the step 9 run has finished green, since the registry validates that the npm version exists: `mcp-publisher login github && mcp-publisher publish`
+10. **Publish to the MCP Registry** — only **after** the step 9 run has finished green, since the registry validates that the npm version exists: `mcp-publisher login github && mcp-publisher publish`. If login fails with `incorrect_device_code`, the local binary is stale: compare `mcp-publisher --version` against the [latest release](https://github.com/modelcontextprotocol/registry/releases) and update it — the device-auth flow has changed between versions, and the error does not say so
 11. **Deploy to Cloudflare** (if code changed): `npm run deploy`
 
 See `docs/DEPLOYMENT.md` for detailed Cloudflare deployment instructions.

LOG.md

@@ -6,6 +6,10 @@
 
 First release published from CI. No functional change: this exists to exercise the release workflow added earlier today end to end — tag guard, OIDC authentication, provenance attestation — rather than discovering whether it works during a release that actually matters.
 
+Worked on the first try: the job went green in 34s and the attestation binds the tarball to `ondata/ckan-mcp-server`, workflow `release.yml`, ref `refs/tags/v0.4.115`, on a GitHub-hosted runner. `npm view @aborruso/ckan-mcp-server@0.4.115 dist.attestations` returns an SLSA v1 provenance; the same query on the hand-published 0.4.114 returns nothing.
+
+One snag worth remembering: `mcp-publisher` failed with an expired JWT, and re-running `login github` then died with `incorrect_device_code` before the browser step. Neither error named the real cause — the local binary was **1.5.0 from 6 March**, and the device-auth flow changed by **1.8.0**. Updating the binary fixed it. When the registry token expires, check the publisher version too: both were installed the same day and go stale together.
+
 
 
 ### npm provenance: release workflow on tags