What changed

• replace long-lived NPM_TOKEN publishing with npm Trusted Publishing over OIDC
• use an approval-gated npm GitHub environment
• prepare beatapi and beatapi-client 0.1.1 with normalized package metadata
• document the release setup and add a workflow security regression test

Why

The existing workflow referenced a missing NPM_TOKEN and could not publish from GitHub Actions. Trusted Publishing removes the long-lived credential and adds verifiable npm provenance.

Verification

• npm run verify
• 20/20 tests pass
• both 0.1.1 package tarballs install and execute in the package smoke test
• npm audit --omit=dev reports 0 vulnerabilities