release: avoid package.json drift during publish