docs(release): explain package provenance

[Mr-Neutr0n]

Summary

• document the relationship between the npm package tag, bundled plugin manifest, and Codex runtime dependencies
• use the Git tree object as the immutable bundled-content identifier
• explain how to verify package gitHead and integrity metadata, and why external catalog versions must come from runtime release metadata

Fixes #234.

Verification

• verified the tag, commit, tree, package, and manifest commands against the current checkout
• pnpm run format passes
• model generation, diff, secret, burst, title, and repository-preflight checks pass

[mldangelo-oai]

Thanks for addressing #234. The tag-to-commit-to-bundled-tree mapping is useful, and the published 0.1.5 bundle matches its tagged source. Before merging, please distinguish signed provenance verification from registry metadata inspection and document the supported historical releases that do not expose gitHead.

[Mr-Neutr0n]

Addressed the review: clarified that npm registry metadata is inspection-only, documented signed SLSA verification with npm audit signatures, and named 0.1.0/0.1.1 as the only legacy releases that may omit gitHead. Mr-Neutr0n@29e0bed