[Feat]: Serve the plugin only from released commits and fix the private-repository docs #19

Summary

As a plugin user, I want the marketplace to give me only released plugin versions, and the docs to stop saying the repository is private.

Motivation

• Miragon/bpmn-cli is public: an install without GitHub credentials works, and every npm version since 0.1.1 has SLSA provenance. docs/releasing.md and the npm publish comment in release-please.yml still say the repository is private and has no provenance.
• The marketplace entry "source": "./plugins/bpmn-cli" resolves from the tip of main. A fresh install can get a skill ahead of its CLI (65 min between feat: bpmn render — SVG/PNG for agents with crops, halos and numbered layout problems (#12) #15 and 0.5.0: the skill ran bpmn render on a pinned 0.4.0), or one pinning a version npm does not have yet (4 to 6 min per release). Such a copy carries the release's version string, so claude plugin update keeps it until the next release.

Proposed Solution

1. Fix the provenance statements (docs: state that npm adds provenance to releases of the public repository #124).
2. Install the plugin from a branch release (fix(plugin): serve the plugin from the release branch, moved only after npm publish #125):
   • marketplace.json: git-subdir source, https:// URL, path: plugins/bpmn-cli, ref: release. The https URL matters: the owner/repo shorthand goes through the SSH probe.
   • release-please.yml: a job after publish fast-forwards release to the tag (GitHub API, force=false), so the branch only moves once npm has the version.

Acceptance Criteria

• No doc says the repository is private or lacks provenance.
• release exists at the latest tag before the marketplace change is merged.
• marketplace.json installs from release via git-subdir, without a version.
• release moves only after publish succeeded, fast-forward only, contents: write scoped to that job.
• docs/releasing.md describes the branch and how to recover from a failed move.
• test/e2e/plugin.test.ts checks the new entry; claude plugin validate --strict passes in CI.
• After the next release: an existing bpmn-cli@miragon-bpmn install updates to it without a reinstall, and only once npm has the version.

Alternatives Considered

• A separate public marketplace repo: no gain while this repo is public; only worth it as a Miragon-wide catalog.
• An npm plugin source: the package root would have to be the plugin root (bin/ lands on PATH), so it needs a second package.
• Release-please bumping ref: vX.Y.Z: its updater drops the v, and main would point at a tag before npm has it.
• Users add Miragon/bpmn-cli#release: changes the install command, existing users keep tracking main.