jumpring v0.1.1

jumpring v0.1.1

No functional changes. The keystore format, the cryptography, and the command
surface are all unchanged; keystores written by 0.1.0 are unaffected.

• Provenance. Releases are now published from CI using npm Trusted Publishing
  (OIDC), so every published tarball carries a signed attestation binding it to
  this repository and the exact commit it was built from. No long-lived publish
  token exists. Verify with npm audit signatures after install, or on each
  package's npm page.
• Manifests link their source. All three packages now carry repository,
  homepage, and bugs fields.
• Documentation. Added guidance on pinning versions, building from source, and
  key hygiene for agent operators.

Known issue: jumpring --version reports 0.1.0 in this release regardless of
the installed version. It is fixed in 0.1.2, which reads the version from the
package manifest.

MIT licensed. See the README for the threat model.