[joe-broadhead]

Release kit revision b8b230e (from opencode-gws, #47), with its test-only follow-up 4e69d9d (#48: the decoy repository's commit is made with plumbing, so git's background auto-maintenance cannot change it on newer macOS runners). The release workflow is unchanged; the kit now keeps the plugin off npm for good.

• package.json is "private": true (OD-33), so npm can never publish the plugin by accident. A GitHub install (opencode plugin add github:joe-broadhead/opencode-<name>#v<version>) does not read it, and npm pack still packs the release tarball. The release planner, the build step and the release-shape check require it, and the release commit keeps it.
• npm run check (the kit tests) checks that package.json is private and in its canonical form, JSON.stringify(pkg, null, 2) and one newline, as the release planner does; before, only the planner did, at release time.
• The kit tests clear every GIT_ variable before running git, so under git rebase --exec they no longer write the shared .git/config.
• A kit test that the publish-side native check covers every module of a manifest.
• CONTRIBUTING's Releasing section says so.

This PR changes only kit files: the release scripts and their tests, CONTRIBUTING's Releasing section and package.json's "private": true line. The revision was rehearsed on opencode-release-rehearsal (v0.0.2). No repository setting changes.