release: npm 1.0.1 patch (operator CLI + worker deps)

[ContextForgeAI]

Summary

• Bump npm semver to 1.0.1 (VERSION, @ff-occam/mcp, ff-occam, skill cards, server.json).
• Pin HOST_RELEASE_VERSION=1.0.0 so npx @ff-occam/mcp@1.0.1 still downloads the published GitHub v1.0.0 host tarball (no signed GitHub cut required for this patch).
• Documents npm-only scope in CHANGELOG; guarded install default (PUBLIC_DEFAULT_RELEASE_VERSION) stays 1.0.0.

After merge

1. Run Actions → npm publish with npm_tag=latest (not rc).
2. Smoke: npx ff-occam@1.0.1 connect → refusal + get-ff-occam pointer; npx @ff-occam/mcp@1.0.1 → downloads host 1.0.0 + installs worker deps.

Test plan

• node --test packages/occam-mcp/test/*.test.js packages/ff-occam/test/package.test.js
• node scripts/check-docs.mjs
• CI green
• npm publish workflow (manual, post-merge)