npm go-live: publish 1.5.3 as latest; neutralize legacy 1.0.0

[styk-tv]

Bring the modern client live on npm.

• Configure npm auth: OIDC Trusted Publishing (no stored token, recommended) OR an NPM_TOKEN automation-token repo secret. [decision pending]
• Release v1.5.3 (version bump + tag) -> CI publishes OCI and npm with provenance; latest moves to 1.5.3.
• Neutralize legacy 1.0.0 (deprecate; and/or unpublish if npm policy allows).
• Verify: npm view @conceptkernel/cklib version -> 1.5.3; npm page renders corrected README; npm audit signatures passes.

Blocked on: npm auth decision + tag authorization.

[styk-tv]

Deferred per request — gated on npm auth (NPM_TOKEN or OIDC trusted publishing). When ready: configure auth + set repo var NPM_PUBLISH=true, then a tag release publishes OCI + npm with provenance, and legacy 1.0.0 gets neutralized.

[styk-tv]

Status 2026-07-02. Blocked on npm auth (the single remaining input — see #3 for the completed wiring). The tracked tree is release-ready: v1.5.3 is shipped and attested on the OCI side, so the first npm publish will carry whatever tag is current at activation (1.5.3 today; a later tag if one ships first).

Go-live sequence (no code change):

1. Configure auth — NPM_TOKEN secret or OIDC Trusted Publishing for @conceptkernel/cklib.
2. Set repo var NPM_PUBLISH=true.
3. Next tag → CI publishes with --provenance, then hard-gates on dist-tags.latest resolving to the released version.
4. Neutralize legacy 1.0.0 (npm deprecate — it predates the current architecture and must not be installed).

Navigation boundaries. npm is a convenience distribution of the same byte-set as the attested OCI bundle — the OCI artifact remains the canonical, attestation-verified surface consumed downstream by oci-germination / sporaxis compositions. Nothing here changes the substrate contract (pgCK) or touches RDF concerns (pgRDF).