Publish @domscribe/protocol@1.0.0 to npm + verify non-author install

[Narrator]

Sprint 2491 — task T7 (Batch B)

Closes out the sprint-2491 trip-wire from DOP memo + PE RFC 0002. This is the literal artifact the bet is measured against.

Scope

• pnpm publish of @domscribe/protocol@1.0.0 to npm public registry
• Verification that a fresh pnpm add @domscribe/protocol on a clean machine resolves and imports cleanly with no warnings
• Telemetry smoke: a fresh non-author install with telemetry opted in produces ≥1 real session arrival at the Cloudflare Worker endpoint (validates the DOP falsifier instrumentation actually works end-to-end)
• Release post draft (LinkedIn / X / blog) explicitly using the "build-time complement to WebMCP and Chrome DevTools MCP" framing — NOT "competitor" — per DOP risk note
• Tag commit protocol-v1.0.0 and link from docs/rcp/v1.md version banner

Acceptance

• @domscribe/protocol@1.0.0 resolvable on npm
• Verification run from a non-author machine produces a clean import
• Telemetry endpoint logs at least one session from the verification install
• Release post draft reviewed by Kaushik before publication (positioning is load-bearing)
• CHANGELOG updated; tag pushed

Depends on

#32 (package exists), #33 (canonical names + aliases), #34 (telemetry live), NEW SourcePosition issue, #35 (stability policy doc).

Trip-wire

If this issue does not close by 2026-06-12, the sprint missed its DOP-level trip-wire — escalate to Kaushik immediately. Per RFC 0002: partial v1 is strictly worse than late v1.

Risk

Publishing v1 the same week as Google's WebMCP announcement risks "niche protocol vs platform standard" framing. Release-post wording must explicitly land "complement at a different layer," not "compete." Kaushik signoff before public post.