Publish @spore-host/truffle-ts to npm (drop the git dependency)

[scttfrdmn]

spawn-ts consumes truffle-ts as a git dependency (git+https://github.com/spore-host/truffle-ts.git#v0.3.0), which required a CI/Pages workaround: git config url."https://github.com/".insteadOf "git@github.com:" before npm ci (npm normalizes the lockfile URL to git+ssh). Publishing to npm removes that friction for any consumer.

Work

• truffle-ts: decide npm org/scope access for @spore-host; add a publish workflow (tag-triggered, npm provenance / --provenance); publish v0.3.0 (or next).
• spawn-ts: flip the dependency from the git URL to a semver range (^0.3.0); remove the insteadOf rewrite steps from .github/workflows/ci.yml + pages.yml.

Acceptance

• @spore-host/truffle-ts resolvable via npm install @spore-host/truffle-ts.
• spawn-ts package.json uses a semver range; lockfile no longer has a git URL.
• The git@github→HTTPS CI steps are gone and CI stays green.

Size: small. (Cross-repo; the publish half lives in truffle-ts.)

[scttfrdmn]

✅ Done. @spore-host/truffle-ts@0.4.0 is published to npm (npm dist-tag ls → latest: 0.4.0). spawn-ts now consumes it as ^0.4.0 from the registry and the git@github→HTTPS CI rewrite is removed from all three workflows (PR #41).

First publish was a one-time manual npm publish --auth-type=web (passkey via browser) — npm trusted publishing can't bootstrap a never-published package name. Follow-up for token-free automated releases: register the trusted publisher on npmjs.com (Packages → @spore-host/truffle-ts → Settings → Trusted Publishing: GitHub Actions, owner spore-host, repo truffle-ts, workflow publish.yml, no environment), then merge truffle-ts PR #24 (drops NPM_TOKEN for OIDC).