docs: document consuming the registry as an npm dependency

[lmcorbalan]

Summary

Closes #163

A downstream repository had no instructions for consuming the registry service, and five earlier changes in this epic left several documents describing an install lifecycle and a CI pipeline that no longer exist.

Changes

• README.md gains a "Consuming the registry service" section: the pinned dependency line, the git-credentials and participant preconditions, the full environment, and the pnpm build-script allowlist without which a pnpm install fails outright.
• CLAUDE.md, ARCHITECTURE.md and SPEC.md gain the two new commands, the third CI check and both new scripts; SPEC.md's size figures are re-derived and now name the command that produced them.
• RUNBOOK.md states that every v[0-9]* tag is a DAR release, the npm pin included.

Acceptance criteria

• All twelve from the issue are met, with one deliberate divergence: package.json's description is edited, so the diff carries one non-.md file. That was the chosen resolution of the issue's own comment asking for a decision on the shipped manifest.

Test plan

Automated tests

npm run check:deps exit 0. The daml check's ungated README-snippet comparison, extracted from ci.yml and run locally, prints ok.

Manual verification

Every documented command was run literally from a scratch consumer outside the repository, against the real private repo, on npm 9.2.0 and pnpm 11.25.0: the install links the bin and running it exits 1 naming LEDGER_API_URL, and pnpm reproduces the documented refusal until the allowlist entry is added. The README's yaml block was extracted and parsed. All four line counts and the 24-entry package listing were re-derived.

Breaking changes

None