feat(publish): make package installable from Gitea npm registry (WHYNOT-WP-0003 T02)

- package.json: private:false; real repository.url; publishConfig.registry →
  coulomb Gitea npm; lit dependency → peerDependency (^3) + devDependency;
  ship the ir/ consumer contract (files + ./ir/* export); add PUBLISHING.md to files.
- .npmrc: real @whynot scope registry + ${NPM_AUTH_TOKEN} ref (no secret committed).
- PUBLISHING.md: publish flow, token routing (operator/OpenBao — warden route is not
  in this CLI), and consumer install.
- README: registry-install path + lit peer note. CHANGELOG: Added/Changed entries.

Config + packaging validated via `npm pack --dry-run` (ir/, tokens, CSS, PUBLISHING.md
included; .npmrc excluded). Actual `npm publish` + install-verify is gated on a Gitea
NPM_AUTH_TOKEN (operator-owned) and an explicit outward-publish go-ahead.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

package.json

@@ -2,7 +2,7 @@
   "name": "@whynot/design",
   "version": "0.3.0",
   "description": "The neutral, mostly-black-and-white visual language for whynot — prototype cards, signal records, beta plans, decision documents, and any other deliberately-unfinished artefact. Ships tokens, CSS, and Lit-based web components consumable from React, Django, Vue, plain HTML, or anywhere a custom element runs.",
-  "private": true,
+  "private": false,
   "type": "module",
   "main": "./src/index.js",
   "module": "./src/index.js",
@@ -21,17 +21,20 @@
     "./tokens/type":                  "./tokens/type.json",
     "./tokens/spacing":               "./tokens/spacing.json",
     "./adapters/django":              "./adapters/django/README.md",
+    "./ir/*":                         "./ir/*",
     "./assets/*":                     "./assets/*",
     "./skill":                        "./SKILL.md"
   },
   "files": [
     "src",
     "tokens",
+    "ir",
     "assets",
     "adapters",
     "SKILL.md",
     "DesignSystemIntroduction.md",
     "MultiFrameworkSupport.md",
+    "PUBLISHING.md",
     "README.md",
     "CHANGELOG.md"
   ],
@@ -47,16 +50,20 @@
     "showcase": "npx --yes serve -l 4321 .",
     "example": "npx --yes serve -l 4322 examples/whynot-control"
   },
-  "dependencies": {
-    "lit": "^3.2.1"
+  "peerDependencies": {
+    "lit": "^3"
   },
   "devDependencies": {
-    "@playwright/test": "^1.45.0"
+    "@playwright/test": "^1.45.0",
+    "lit": "^3.2.1"
   },
   "keywords": ["whynot", "design-system", "wireframe", "prototype", "lit", "web-components", "django", "react"],
   "repository": {
     "type": "git",
-    "url": "git+ssh://git@gitea.example.com/whynot/whynot-design.git"
+    "url": "git+ssh://git@gitea.coulomb.social/coulomb/whynot-design.git"
+  },
+  "publishConfig": {
+    "registry": "https://gitea.coulomb.social/api/packages/coulomb/npm/"
   },
   "license": "UNLICENSED"
 }