docs: record npm publication closeout

[Chumaniac]

What changed

• Record that @chumanic/skillsync@0.1.0 is publicly available on npm.
• Document the clean consumer install, CLI smoke test, and zero-vulnerability package audit.
• Clarify that npm Trusted Publisher setup remains the only release-automation prerequisite for future tag versions.

Why

The initial package was published after the release checks passed, so the public repository documentation should describe the current state rather than the earlier pending publication state.

Validation

• git diff --check
• npm run check — 69 test files passed, 1 skipped; 426 tests passed, 1 skipped; type-check, lint, and build passed.
• Anonymous npm registry metadata lookup for @chumanic/skillsync@0.1.0
• Clean temporary-directory install and skillsync --help

The offline-first runtime boundary remains unchanged; live network access, provider credentials, Docker/microVM execution, and remote Worker execution remain separate security gates.