docs: record npm package bootstrap

[kestiny18]

What

• document the one-time bootstrap required before a new npm package can use per-package Trusted Publishing
• require an isolated owner login, a 0.0.0 placeholder, exact Trusted Publisher settings, and registry verification
• record npm's first-publish latest behavior and cleanup expectations

Why

A brand-new npm package has no settings page for Trusted Publisher configuration, so OIDC-only first publication fails until the package record exists.

Checks

• git diff --check
• verified dsh-redact@0.1.0 and latest in the npm registry
• verified SLSA provenance attestation is present