robinhood-chain-kit v0.8.1

• Release process: CI attests, it no longer publishes. Two attempts to
  publish over OIDC were rejected with a 404 on the PUT while provenance signed
  fine, and the second was unambiguous — the version was not on the registry at
  all, so nothing but the token could have been refused. Rather than leave a
  failed run on every tag, npm run release publishes from a laptop and the
  tag workflow proves the result: it rebuilds the tag's tree and fails unless
  the tarball on npm is byte-identical to it. That is a stronger check than the
  old flow had, because it catches the failure a manual release actually
  introduces — publishing from a dirty tree, a stale dist/, or the wrong
  branch. publishConfig.provenance is removed: with no OIDC provider outside
  CI it made every hand publish fail with EUSAGE, and no released version has
  ever carried an attestation. The workflow header documents exactly how to
  restore CI publishing if the trusted publisher is ever configured.
• npm run release refuses in under a second instead of after thirty.
  scripts/preflight-release.mjs checks the three cheap things first: the
  version is not already on the registry, the working tree is clean, and the
  CHANGELOG has a section for this version. The working-tree check is the one
  that matters — publishing is irreversible and npm does not allow replacing a
  version, so the tag workflow's checksum comparison can only report a bad
  publish after it is already public. This prevents it.
• No consumer-facing code changed in this release; it is release tooling and
  the README section describing it.