feat(publish): make package installable from Gitea npm registry (WHYNOT-WP-0003 T02)

- package.json: private:false; real repository.url; publishConfig.registry →
  coulomb Gitea npm; lit dependency → peerDependency (^3) + devDependency;
  ship the ir/ consumer contract (files + ./ir/* export); add PUBLISHING.md to files.
- .npmrc: real @whynot scope registry + ${NPM_AUTH_TOKEN} ref (no secret committed).
- PUBLISHING.md: publish flow, token routing (operator/OpenBao — warden route is not
  in this CLI), and consumer install.
- README: registry-install path + lit peer note. CHANGELOG: Added/Changed entries.

Config + packaging validated via `npm pack --dry-run` (ir/, tokens, CSS, PUBLISHING.md
included; .npmrc excluded). Actual `npm publish` + install-verify is gated on a Gitea
NPM_AUTH_TOKEN (operator-owned) and an explicit outward-publish go-ahead.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

workplans/WHYNOT-WP-0003-downstream-consumption.md

@@ -100,7 +100,7 @@ tagged. Tag the current state as the first real anchor.
 
 ```task
 id: WHYNOT-WP-0003-T02
-status: todo
+status: wait
 priority: high
 state_hub_task_id: "dbd3a2e6-0623-4efd-8293-399002e85ea2"
 ```