release: prepare KB npm bootstrap

[0thernet]

Summary

• prepares @hraness/kb@0.17.1 for its first public npm release
• adds conservative dual-use metadata and the packaged disclosure
• adds exact Bun/npm tarball consumer verification with bounded inventory and size
• adds tokenless, stage-only trusted publishing for later versions
• requires the public npm artifact to match source before creating the immutable GitHub Release
• documents the interactive 2FA bootstrap and later release sequence

Verification

• bun run check
• 1,180 tests, 0 failures
• exact tarball installed and exercised with Bun and npm
• clean runtime audit: 0 vulnerabilities
• generated dist/ and bun.lock remained unchanged

The first npm publication, trusted-publisher configuration, tag, and GitHub Release intentionally follow only after this source change is merged and the exact main-branch artifact is reviewed.