Until now the only route was `npm install -g github:0Smallcat0/OpenRead`,
which clones and builds from source and takes a couple of minutes. Fine for a
contributor; far too much for someone who wants to translate one paragraph
without sending it to a cloud.

The release workflow has published on tag since 2.6.1. What was missing was
the NPM_TOKEN secret, which only the maintainer can create. Publishing carries
--provenance, so the tarball on npm traces back to the tag and the workflow
run that built it.

The README documents `npx openread` because it is now true. It said so once
before, in 2.6.0, when the package did not exist — that line was removed in
2.6.1 rather than left for whoever tried it to discover.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>