feat(publish): make package installable from Gitea npm registry (WHYNOT-WP-0003 T02)

- package.json: private:false; real repository.url; publishConfig.registry →
  coulomb Gitea npm; lit dependency → peerDependency (^3) + devDependency;
  ship the ir/ consumer contract (files + ./ir/* export); add PUBLISHING.md to files.
- .npmrc: real @whynot scope registry + ${NPM_AUTH_TOKEN} ref (no secret committed).
- PUBLISHING.md: publish flow, token routing (operator/OpenBao — warden route is not
  in this CLI), and consumer install.
- README: registry-install path + lit peer note. CHANGELOG: Added/Changed entries.

Config + packaging validated via `npm pack --dry-run` (ir/, tokens, CSS, PUBLISHING.md
included; .npmrc excluded). Actual `npm publish` + install-verify is gated on a Gitea
NPM_AUTH_TOKEN (operator-owned) and an explicit outward-publish go-ahead.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,20 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Version
 
 ## [Unreleased]
 
+### Added
+
+- **Publishable to the coulomb Gitea npm registry** (WHYNOT-WP-0003 T02) — `private:false`,
+  `publishConfig.registry`, real `repository.url`, an `.npmrc` scope + `${NPM_AUTH_TOKEN}`
+  reference (no secret committed), and `PUBLISHING.md` (publish flow + consumer install +
+  token routing). The package now ships the `ir/` consumer contract (added to `files` and
+  the `./ir/*` export) so consumers can pin a version and track it.
+
+### Changed
+
+- **`lit` is now a `peerDependency`** (`^3`), not a direct dependency. Consumers must
+  install `lit` alongside `@whynot/design` (`npm i @whynot/design lit`) so their bundler
+  dedupes to a single `lit` instance.
+
 ## [0.3.0] — 2026-06-27
 
 ### Added