v0.3.0 — on npmjs, no token required

The first release published to npmjs.org, and the first one installable without a token.

npm install -g mehmory

Requires Node.js 22 or newer.

Changed

The package is mehmory on npmjs, not @elderfo/mehmory on GitHub Packages. GitHub
Packages has no anonymous read, so the documented install told every reader to mint a
read:packages token before they could try the tool — a private-repo arrangement that
outlived the private repo. Installing now needs no registry configuration and no token.
Releases authenticate with an NPM_TOKEN secret instead of the workflow's GITHUB_TOKEN,
and the release-workflow test asserts the old registry and scope are absent rather than
present, so a half-revert fails loudly.

Anyone on the old package should replace it:

npm uninstall -g @elderfo/mehmory && npm install -g mehmory

@elderfo/mehmory stays published on GitHub Packages at 0.2.1 rather than being deleted —
removing it would break existing installs. The @mehmory/mehmory name on npmjs is a
reservation stub containing no code; it exists so the scope can't be claimed by someone
else, and points at mehmory.

Added

Contributor and security docs, now that the repository is public: CONTRIBUTING.md,
SECURITY.md (private vulnerability reporting, with the secret filter named as the
security-relevant surface), CODE_OF_CONDUCT.md, issue forms, and a pull request template.

Security

CI runs on fork pull requests, so ci.yml declares permissions: {} at the workflow
level and contents: read on the job instead of inheriting the repository default. Secret
scanning, push protection, and Dependabot alerts are enabled on the repository.

---

Full changelog: https://github.com/elderfo/mehmory/blob/main/CHANGELOG.md
Compare: v0.2.1...v0.3.0