Pin companion compatibility and normalize npm distribution tags

[mattheliu]

Outcome

An unqualified npm install resolves to the current reviewed companion release, and package metadata does not advertise untested DSH compatibility.

Acceptance evidence

• DSH client peer dependencies are scoped to the tested 0.1.1-rc.2 line.
• README installation commands, changelog, package metadata, and roadmap agree.
• Typecheck, tests, build, and package dry-run pass.
• The npm package includes governance, accessibility, roadmap, research, security, and contribution documents.
• The beta and latest dist-tags resolve to the intended published version.
• Registry metadata and a clean install are verified after publication.

[mattheliu]

Progress on 2026-08-29:

• Published 0.1.0-beta.6 through the trusted GitHub OIDC workflow with SLSA provenance.
• Registry metadata confirms exact DSH 0.1.1-rc.2 client peers, package integrity, and all 27 intended files.
• The beta dist-tag now resolves to 0.1.0-beta.6.
• The legacy latest dist-tag still resolves to 0.1.0-beta.3.

The package uses tokenless trusted publishing. npm OIDC currently authorizes npm publish but not npm dist-tag, and no long-lived npm token is configured locally or in the repository. Final acceptance therefore requires an npm maintainer presence check to set latest to 0.1.0-beta.6, followed by registry and clean-install verification. The package Settings page is ready at its security-key prompt; no credential or participant data is being handled.