distribution: migrate npm publish to Trusted Publishers, finalise landing page

Switch the release workflow from a long-lived npm token to OIDC
Trusted Publishing — drops the COMPOSIT_DEPLOY_TOKEN dependency,
adds id-token: write permission to the npm job, upgrades npm to the
OIDC-capable line, and emits provenance attestations on publish.

Each of the six packages still has to list this workflow as a Trusted
Publisher on npmjs.com (Repository: nuetzliches/composit, Workflow:
release.yml) for the publish to succeed.

Landing page: drop the "soon" badges and "requires first release"
hedges from the brew, npx, and curl tabs — all three channels are
live for v0.3.1. Update the npx tab to reference @nutz/composit
(the @composit scope on npm is owned by someone else).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 7schmiede

.github/workflows/release.yml

@@ -188,49 +188,45 @@ jobs:
     name: Publish to npm
     runs-on: ubuntu-latest
     needs: release
-    # Requires the secret COMPOSIT_DEPLOY_TOKEN (an npm automation token
-    # with publish rights to the @nutz scope). When the secret is absent
-    # the job short-circuits so the rest of the release still completes.
-    env:
-      NPM_TOKEN: ${{ secrets.COMPOSIT_DEPLOY_TOKEN }}
+    # Auth via npm Trusted Publishers (OIDC). Each of the six packages
+    # (@nutz/composit + 5 platform sub-packages) must list this workflow
+    # as a Trusted Publisher on npmjs.com — otherwise publish fails with
+    # 401. No long-lived NPM_TOKEN required.
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - uses: actions/checkout@v6
-        if: env.NPM_TOKEN != ''
       - uses: actions/setup-node@v4
-        if: env.NPM_TOKEN != ''
         with:
           node-version: 20
           registry-url: https://registry.npmjs.org
+      - name: Upgrade npm to OIDC-capable version
+        run: npm install -g npm@latest
       - uses: actions/download-artifact@v8
-        if: env.NPM_TOKEN != ''
         with:
           pattern: composit-*
           path: artifacts
       - name: Flatten artifacts
-        if: env.NPM_TOKEN != ''
         shell: bash
         run: |
           set -euo pipefail
           mkdir -p artifacts-flat
           find artifacts -type f \( -name '*.tar.gz' -o -name '*.zip' \) -exec cp {} artifacts-flat/ \;
           ls -la artifacts-flat
       - name: Build sub-packages
-        if: env.NPM_TOKEN != ''
         shell: bash
         run: |
           set -euo pipefail
           VERSION="${GITHUB_REF#refs/tags/v}"
           node install/npm/build-packages.mjs "$VERSION" artifacts-flat dist/npm
       - name: Publish platform sub-packages, then meta
-        if: env.NPM_TOKEN != ''
         shell: bash
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.COMPOSIT_DEPLOY_TOKEN }}
         run: |
           set -euo pipefail
           for d in dist/npm/*/; do
             name=$(basename "$d")
             [ "$name" = "meta" ] && continue
-            (cd "$d" && npm publish --access public)
+            (cd "$d" && npm publish --provenance --access public)
           done
-          (cd dist/npm/meta && npm publish --access public)
+          (cd dist/npm/meta && npm publish --provenance --access public)

landing/index.html

@@ -485,16 +485,16 @@ <h2>Quick start</h2>
             codespaces <span class="tab-badge badge-ok">available</span>
           </button>
           <button class="tab-btn" role="tab" data-tab="brew">
-            brew <span class="tab-badge badge-soon">soon</span>
+            brew <span class="tab-badge badge-ok">available</span>
           </button>
           <button class="tab-btn" role="tab" data-tab="npx">
-            npx <span class="tab-badge badge-soon">soon</span>
+            npx <span class="tab-badge badge-ok">available</span>
           </button>
           <button class="tab-btn active" role="tab" data-tab="cargo">
             cargo <span class="tab-badge badge-ok">available</span>
           </button>
           <button class="tab-btn" role="tab" data-tab="curl">
-            curl <span class="tab-badge badge-soon">soon</span>
+            curl <span class="tab-badge badge-ok">available</span>
           </button>
           <button class="tab-btn" role="tab" data-tab="docker">
             docker <span class="tab-badge badge-ok">available</span>
@@ -521,7 +521,7 @@ <h2>Quick start</h2>
         <!-- brew -->
         <div class="tab-panel" id="tab-brew" role="tabpanel">
           <div class="tab-panel-header">
-            <span>macOS · Linux — requires first release</span>
+            <span>macOS · Linux</span>
           </div>
           <div class="tab-section">
             <div class="tab-section-head">
@@ -532,24 +532,24 @@ <h2>Quick start</h2>
 brew tap nuetzliches/tap
 brew install composit</pre>
           </div>
-          <div class="tab-note">Formula at <a href="https://github.com/nuetzliches/composit/blob/main/install/brew/composit.rb" target="_blank" rel="noopener">install/brew/composit.rb</a> — SHA256 placeholders filled on first GitHub release.</div>
+          <div class="tab-note">Formula tracked at <a href="https://github.com/nuetzliches/homebrew-tap/blob/main/Formula/composit.rb" target="_blank" rel="noopener">nuetzliches/homebrew-tap</a>; auto-bumped by the release workflow.</div>
         </div>
 
         <!-- npx -->
         <div class="tab-panel" id="tab-npx" role="tabpanel">
           <div class="tab-panel-header">
-            <span>Zero-install · CI-friendly — requires first release</span>
+            <span>Zero-install · CI-friendly</span>
           </div>
           <div class="tab-section">
             <div class="tab-section-head">
               <span>Use</span>
-              <button type="button" class="qs-copy" data-copy="npx @composit/cli init">Copy</button>
+              <button type="button" class="qs-copy" data-copy="npx @nutz/composit init">Copy</button>
             </div>
 <pre><span class="comment"># No install step — npx downloads on first use.</span>
-npx @composit/cli init
-npx @composit/cli diff --output json</pre>
+npx @nutz/composit init
+npx @nutz/composit diff --output json</pre>
           </div>
-          <div class="tab-note">Meta-package at <a href="https://github.com/nuetzliches/composit/blob/main/install/npm/package.json" target="_blank" rel="noopener">install/npm/</a> — selects a platform binary via optional dependencies (biome / esbuild pattern).</div>
+          <div class="tab-note">Meta-package <a href="https://www.npmjs.com/package/@nutz/composit" target="_blank" rel="noopener">@nutz/composit</a> selects a platform binary via optional dependencies (biome / esbuild pattern).</div>
         </div>
 
         <!-- cargo -->
@@ -571,7 +571,7 @@ <h2>Quick start</h2>
         <!-- curl -->
         <div class="tab-panel" id="tab-curl" role="tabpanel">
           <div class="tab-panel-header">
-            <span>macOS · Linux — requires first release</span>
+            <span>macOS · Linux</span>
           </div>
           <div class="tab-section">
             <div class="tab-section-head">