feat: publish to npm, over trusted publishing

[lex00]

Closes #134.

private: true meant "open your own project" started with "clone this repo and run it from the checkout". kubemicrovm-ops ships BEHOLD_DIR handling and a bespoke error message for exactly that, and every other consumer would invent its own.

The package

private removed. publishConfig sets access: public — a scoped package's first publish is restricted otherwise — and provenance: true.

Nothing else needed changing: bin, files: [bin, dist, web] and prepublishOnly were already right.

Trusted publishing, not a token

release.yml publishes over OIDC. npm mints a short-lived credential for this repository and this workflow filename, so there is no NPM_TOKEN to leak, rotate, or scope wrongly.

Two things have to line up outside this PR:

1. On npmjs.com → the package → Settings → Trusted Publisher, naming this repo and release.yml. Until that exists the publish step fails rather than falling back to anything, which is the behaviour you want.
2. id-token: write on the job — declared here. Neither alone is enough.

npm is upgraded explicitly: trusted publishing needs 11.5.1+, and while Node 24 ships an npm 11 the exact patch moves with the runner image. Pinning the floor beats discovering it on a tag.

What it refuses to publish

Typecheck, tests and build run first, then two release-specific gates:

• The tarball must carry bin, dist and web. web is the SPA — a tarball missing it publishes a server with no UI, which looks fine in CI and breaks on install.
• The tag must match package.json's version, so a mistyped tag cannot ship a version nobody asked for.

workflow_dispatch rehearses all of it and publishes nothing.

Verified against a real install, not just a dry run

$ npm pack && npm install ../behold/intentius-behold-0.2.0.tgz
$ ./node_modules/.bin/behold serve /tmp/kubemicrovm-ops --port 4699
installed behold serving on 4699
<title>behold</title>

That exercises the thing most likely to break on packaging: webRoot is dirname(module)/../web, which resolves from src/ in dev and from dist/ when installed, because files ships both at the package root. It served the SPA and a real project's graph.

npm run tsc clean, 433 tests passing.

One thing to settle first

There is no license field and no LICENSE file. npm will warn on publish, and a public package without one is ambiguous for anyone who installs it. Picking a license is not my call, so I have left it alone — but it is worth settling before the first publish rather than after.

Follow-up, not in this PR

Once published, kubemicrovm-ops's just view can drop its checkout-finding logic for npx @intentius/behold serve .. Deliberately held back: that change is wrong until the package actually exists.

[lex00]

Restacked onto main.

This branch carried #133's commit underneath the npm change, so my #139 (which closes the same issue, #131) put it in conflict. That was my doing — I implemented #131 without checking for an open PR on it first.

The npm work itself was never in conflict: 54e440f touches only .github/workflows/release.yml and package.json. The branch is now that commit alone on top of current main, so this PR is what its title says and nothing else.

The zoom-note work it was stacked on is handled separately — #139 landed the bulk, and #133's logicalDegraded partial-projection threshold is being ported as a follow-up, since that part is genuinely better than what I merged.

Original tip 54e440fb7252960cd324d22c4103c888543788b5 if anything needs recovering.

just check: 455 tests, tsc and build clean.