v1.0.1 — Trusted publishing and re-runnable releases

Release pipeline

• Publishing now uses npm trusted publishing (OIDC). There is no NPM_TOKEN secret: the workflow's id-token: write permission is the whole credential, and provenance is still signed at publish time.
• The release job is re-runnable. A version already on the registry is treated as this release having got that far, and the GitHub release step attaches assets to an existing release instead of failing on it. A run that dies after publishing can now be re-run to completion.
• actions/setup-node 5 → 7 and actions/attest-build-provenance 2 → 4, clearing the deprecated always-auth config and the Node 20 runtime warning.

Packaging

• bin.skillsmithy is now scripts/cli.mjs rather than ./scripts/cli.mjs. npm normalized the path anyway, so the installed binary is unchanged; this only silences a misleading "was invalid and removed" warning at publish time.

Documentation

• README documents the trusted-publishing release path.
• Install and verify commands no longer pin a version, using @latest and a <tag> placeholder, so they stay correct across releases.