Release architecture: align versions and prepare optional npm distribution

[rajanbor]

Outcome

Make library, CLI, registry, tags, and documentation follow one explicit release policy before advertising npm installation.

Current evidence

• library version is 0.5.0
• CLI packages are 0.5.1
• tags use both v* and sdk/v*
• supported installation is currently GitHub-only

Constraints

• do not claim a package is published until verified in the public registry
• GitHub installation must remain supported
• registry snapshot and schemas must match the release source
• rollback and compatibility policy must be documented

Acceptance criteria

• Accept an ADR for unified or independently versioned streams
• Validate tag and workflow behavior in a dry run
• Generate release notes from the root changelog
• Verify package provenance, contents, executable, and install smoke test
• Update README only after public package verification

Depends on #103.