feat(publish): make package installable from Gitea npm registry (WHYNOT-WP-0003 T02)

- package.json: private:false; real repository.url; publishConfig.registry →
  coulomb Gitea npm; lit dependency → peerDependency (^3) + devDependency;
  ship the ir/ consumer contract (files + ./ir/* export); add PUBLISHING.md to files.
- .npmrc: real @whynot scope registry + ${NPM_AUTH_TOKEN} ref (no secret committed).
- PUBLISHING.md: publish flow, token routing (operator/OpenBao — warden route is not
  in this CLI), and consumer install.
- README: registry-install path + lit peer note. CHANGELOG: Added/Changed entries.

Config + packaging validated via `npm pack --dry-run` (ir/, tokens, CSS, PUBLISHING.md
included; .npmrc excluded). Actual `npm publish` + install-verify is gated on a Gitea
NPM_AUTH_TOKEN (operator-owned) and an explicit outward-publish go-ahead.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -38,8 +38,18 @@ Framework-agnostic by design. Consumers do **not** re-implement components per f
 
 ### Node-tooled consumer (React, Vite, Next, Vue, …)
 
+Install from the coulomb Gitea npm registry (add the scope to your `.npmrc` first — see
+[`PUBLISHING.md`](./PUBLISHING.md) for the token). `lit` is a peer dependency:
+
+```ini
+# .npmrc
+@whynot:registry=https://gitea.coulomb.social/api/packages/coulomb/npm/
+//gitea.coulomb.social/api/packages/coulomb/npm/:_authToken=${NPM_AUTH_TOKEN}
+```
+
 ```sh
-pnpm add git+ssh://git@gitea.coulomb.social/coulomb/whynot-design.git#v0.3.0
+npm i @whynot/design@v0.3.0 lit
+# or pin straight from git: pnpm add git+ssh://git@gitea.coulomb.social/coulomb/whynot-design.git#v0.3.0
 ```
 
 ```js