Decide: publish acture-a11y to npm (currently private) #70

Part of #64. The accessibility projections (ARIA props from a CommandRecord, aria-keyshortcuts, dispatch-result announcer for WCAG 4.1.3) live in a new workspace package packages/a11y (acture-a11y). It is private: true, so merging does not release it: adding a new npm package name is hard to undo, and AGENTS.md says to ask on irreversible choices.

Recommendation: publish it. It follows the acture-telemetry / acture-undo precedent (small instrumentation package, hand-written equivalent in docs/hand-written-a11y.md), and the announcer must wrap registry.dispatch, which core deliberately does not do.

To do: (1) remove "private": true and set version 0.0.0 in packages/a11y/package.json; (2) add a minor changeset for acture-a11y; (3) with the npm trusted-publishing setup (#65), register the new package name as a trusted publisher on npmjs.com. Step 3 needs the owner's npm account.

Alternative: keep it unpublished and treat docs/hand-written-a11y.md as the only deliverable (then delete the package or leave it as a test bed for the doc).