v1.0.1-beta.1

feat(npm): publish npm packages from tagged releases

Adds a publish-npm job to release.yml (needs: build-release-assets,
continue-on-error: true, isolated from upload-release-assets so a
publish failure never breaks the binary release) that extracts the 6
release archives into raw binaries and hands off to a new dedicated
script, packages/npm/scripts/publish.mjs.

The script stages each binary into its platform package, stamps all 7
package.json versions from the tag (npm accepts prerelease suffixes
directly, so version == tag verbatim, no remapping needed) including
the main package's optionalDependencies pins on the 6 platform
packages, publishes platform packages before the main package with
`npm publish --provenance` (OIDC trusted publishing, no stored token),
and skips any package/version already on the registry for idempotent
re-runs.

Dist-tag policy: stable tags publish to `latest`; beta tags publish to
`beta` and, while no real stable version has ever shipped for a
package, also move `latest` to track the newest beta (otherwise `npx
rhizome-mcp` would stay pointed at the non-functional 0.0.1 bootstrap
placeholder indefinitely, since this project is pre-1.0). Documented
in packages/npm/README.md alongside the script's full CLI contract.

Verified end-to-end via `npm publish --dry-run` and read-only `npm
view` calls against the real, live registry (all 7 packages currently
at 0.0.1/latest, no stable version) - confirmed correct staging,
version/optionalDependencies stamping, publish ordering, the
idempotency skip against a genuinely-published version, and the
latest-follows-beta dist-tag decision. Never ran a real npm publish.

ISSUE-88

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>