fix skill source hydration from lock metadata and bump v0.3.1

refactor CLI into auth/sync groups and keep only GitHub Packages release

ci: validate npm token identity before npmjs publish

chore: trigger release after token rotation

chore: trigger release after NPM_TOKEN setup

ci: bind release job to NPM_TOKEN environment secret

ci: publish npmjs and GitHub Packages in one workflow

ci: support GH_PACKAGES_TOKEN fallback for packages publish

ci: remove whoami gate for GitHub Packages publish

ci: publish GitHub Packages independently of npmjs

chore: validate npm token owner against package scope

chore: switch package scope to @yw9142

chore: add npm auth precheck to release workflow

fix: bind release job to NPM_TOKEN environment

feat: add sync planning workflow and automate release pipeline