Document SDK package provenance and publishing integrity

[silentgeckoaudit3801]

Fixes #126.

Adds package provenance and publishing-integrity guidance for SDK releases, including:

• recommended npm trusted publishing/provenance practices
• maintainer do/don't guidance for release credentials and local publishing
• consumer verification steps for package source, lockfile integrity, and release metadata
• release checklist coverage so provenance stays part of future releases

Validation: static documentation/API review only; no project dependencies or toolchains were run from this environment.

[El-swaggerito]

\nThis PR is currently blocked by merge conflicts.\n\nPlease update the branch with the latest main branch and resolve the conflicts before it can be merged.

[silentgeckoaudit3801]

Closing this PR because the branch history makes the compare include unrelated repository changes after rebasing attempts. I don't want to risk merging anything outside the package-provenance docs scope for #126. I'll reopen from a clean branch if I can get a branch based directly on current main.