Publish reliability: use a scoped automation token so releases can't silently rot on npm again #49

Root cause of this release gap: v0.19.0's npm publish silently failed on an expired token, so npm latest stayed at 0.18.0 for a month while users kept reporting fixed bugs. Today's v0.20.0 publish also needed interactive browser auth (EOTP), which no automation can run.

Fix

Create a granular access token on npmjs.com (Access Tokens → Generate New Token → Granular):

• Packages and scopes: read/write on @hueyexe/opencode-ensemble only
• Expiration: a long rotation window (e.g. 1 year) with a calendar reminder
• Allow bypass 2FA for automation — tokens with this grant skip the interactive OTP flow

Put it in ~/.npmrc on the release machine as:

//registry.npmjs.org/:_authToken=<granular token>

Then bun publish --access public (the documented release step in AGENTS.md) works non-interactively, from any session, including CI or an agent-driven release.

Follow-up hardening (optional, separate PRs)

• Add a post-release smoke check to the release procedure: npm view @hueyexe/opencode-ensemble version must equal the bumped version before cutting the GitHub release
• Consider a weekly scheduled action that opens an issue when npm view ... version lags the GitHub latest release tag — this exact drift went unnoticed for a month