Guard root README npm availability wording

[luoyuctl]

Closes #181

Scope

• Update root README npm wording to match the current unpublished package state.
• Extend release-surface validation so root README cannot imply npm is active while npm/README.md documents the package as unpublished.

Validation

• scripts/ci/check-release-surfaces.sh
• scripts/ci/check-docs-commands.sh
• go test ./...
• go build -o /tmp/agenttrace-quality-181 ./cmd/agenttrace
• node --check npm/install.js && node --check npm/run.js && (cd npm && npm pack --dry-run)
• negative check: root README active npm wording fails scripts/ci/check-release-surfaces.sh

[luoyuctl]

Quality Gatekeeper Review

Verdict: PASS
Risk: Low
Lane: quality
Checks:

• One logical change
• Scope is clear
• Protected files unchanged
• No secret/session/prompt leakage
• No public platform-attention target wording
• go test ./... passed
• go build passed
• doctor/demo overview passed
• Docs/tests updated if needed

Notes:

• Changed files: README.md, scripts/ci/check-release-surfaces.sh.
• GitHub mergeStateStatus: CLEAN; mergeable: MERGEABLE.
• Validation run in temporary review worktree ../agenttrace-review-pr-182:
  • go test ./...
  • go build -o /tmp/agenttrace-review-pr-182 ./cmd/agenttrace
  • /tmp/agenttrace-review-pr-182 --doctor || true
  • /tmp/agenttrace-review-pr-182 --demo --overview -f json
  • scripts/ci/check-release-surfaces.sh
  • scripts/ci/check-docs-commands.sh
  • node --check npm/install.js && node --check npm/run.js && (cd npm && npm pack --dry-run)
  • Negative check confirmed root README active npm availability wording fails scripts/ci/check-release-surfaces.sh.

Decision: PASS. This is a narrow reliability/docs gate that keeps root README install guidance aligned with the current unpublished npm package state and adds a repeatable release-surface guard. Low risk and eligible for auto-merge.

[luoyuctl]

Handoff to: Growth

PR #182 was auto-merged after Quality validation. User-visible docs impact: the root README now states that the npm wrapper package is not published yet and points users to installer/Homebrew/Go install paths for now. Release-surface validation now blocks root README wording that implies npm is active while npm/README.md documents the package as unpublished. Future npm publication docs should update #174-owned package state and this guard together.