docs: verify source tarball installation

[rogerchappel]

Summary

• mark @bargekit/core prominently as unpublished instead of recommending an unavailable npm registry install
• document a source-checkout and local-tarball installation path
• execute that installation path during package smoke and release checks

Verification

• Tests or checks run: npm ci; npm run release:check; bash scripts/validate.sh; git diff --check
• Manual review completed: confirmed npm registry returns E404 and open PRs ci: bump actions/checkout from 4 to 7 #9/ci: bump actions/setup-node from 4 to 7 #15 do not overlap

Risk Level

• Low
• Medium
• High

Notes:

The new assertion rejects a direct registry install while the package is unpublished, checks the documented commands and versioned tarball name, installs a freshly packed tarball in a clean temporary consumer, and imports the package.

Commit-by-commit:

• docs: document source tarball installation
• test: verify documented package installation
• chore: gate releases on install documentation

Rollback Plan

• Revert the three commits to restore the previous README and release-check behavior.

Human Decision Needed

• None
• Maintainer review
• Product/design decision
• Security/privacy review
• Other: