dsh-session-tree v0.1.0-beta.2

Added

• One-command installation and updates through the npm next channel.
• Tokenless npm releases from GitHub Actions through Trusted Publishing, OIDC,
  and automatically generated provenance attestations.

Changed

• The release workflow now transfers one verified archive between isolated
  verification and publishing jobs, checks npm registry digests before and
  after publishing, and keeps GitHub releases as drafts until npm succeeds.
• Chinese and English installation guidance now recommends the precompiled npm
  package while retaining checksum-verifiable GitHub Release artifacts.

Security

• Release retries accept an existing npm version only when its SHA-1 and
  SHA-512 integrity values match the locally verified archive exactly.
• npm publishing uses short-lived GitHub OIDC credentials; no npm token is
  stored in GitHub Secrets.