chore: rebrand to @mantacode/mna-cli + truth-pass docs before first release

[akoso]

Prepares the CLI for its first npm release under the @mantacode scope. Packaging metadata and documentation only — no source files touched.

Rename

The package becomes @mantacode/mna-cli (was @mynextadventure/cli). The @mantacode scope will hold multiple products, so the package name carries the product prefix. The installed binary is unchanged: mna.

Homebrew references are now consistent on mantacode/homebrew-tap → brew install mantacode/tap/mna. The tap repo doesn't exist yet; creating it is a release-time step (documented in RELEASING.md).

The scope name appears nowhere in src/ — there's no update-check, user-agent, or embedded package name — so this is confined to packaging and docs.

Packaging

• Added publishConfig.access: "public". The release workflow already passed --access public; this is belt-and-braces, since npm treats scoped packages as private by default and that bites hardest on the first publish.
• Added repository / homepage / bugs / keywords for the npm page.
• npm pack --dry-run verified: @mantacode/mna-cli@0.0.1, ships dist/mna.js, skills/**, README.md, LICENSE.

Version deliberately left at 0.0.1 — RELEASING.md owns the bump.

RELEASING.md

Rewrote the first-release checklist, which assumed an org that doesn't apply (@mantacode is the owner's personal npm scope, so nothing needs creating) and told you to hand-publish a placeholder version. It now:

• States the first-release version explicitly: 0.1.0, not 1.0.0. 1.0.0 is reserved as the signal that the /v1/ contract is frozen and breaking changes require /v2/ — that commitment shouldn't be made on day one, and homebrew/mna.rb already carries 0.1.0 as its placeholder.
• Warns that NPM_TOKEN must exist before the tag is pushed. The publish-npm job runs on tag push; without the secret it fails, and the burned version number can never be reused.
• Points the tap at mantacode/homebrew-tap, noting the homebrew- prefix is what makes brew install mantacode/tap/mna resolve.

DEVELOPMENT.md

Two factual errors:

• It documented the codegen source priority backwards — claimed the live URL is tried first with the snapshot as fallback, but scripts/codegen.ts tries the committed snapshot first. Corrected, and added the incantation to force production.
• It still said releasing was "out of scope until Phase 8" and pointed at a design doc in another repo. Now points at RELEASING.md.

README

Fixed git clone https://github.com/mynextadventure/mna-cli (that org doesn't exist) and the paste-token host (app.mynextadventure.cloud). Kept the "npm and Homebrew distribution land with the first tag" line as-is until the release.

On the skill truth-pass

This PR was originally scoped to also rewrite skills/mna/SKILL.md, which used to advertise "Phase 0 capabilities (read-only)". That's already done — #3 replaced it with the whole-trip-planning playbook a month ago. No changes needed here, and skills/ is untouched.

However, auditing it surfaced a genuine problem: the skill documents --start-date / --end-date / --free-cancellation-until flags that don't exist on main, because the commit implementing them was lost by a stacked merge. Since citty silently ignores unknown flags, following the skill silently drops the dates. Fixed separately in #5 — worth merging both before the first tag.

Verification

bun install, bun run codegen, bun run typecheck, bun run lint, bun test (22 pass / 0 fail) and bun run build all green. CI green on this branch.

Pre-existing and untouched: biome check's formatter disagrees with the repo's committed JSON/semicolon style on main too; CI runs biome lint, which is clean.