chore: npm trusted publishing (OIDC), one tagline everywhere, dependency bumps, public copy

[shtse8]

Follow-ups to 0.2.0.

• npm trusted publishing (OIDC) with provenance; release.yml no longer reads the long-lived NPM_TOKEN. Owner step before the next release: add the trusted publisher (GitHub Actions, org SylphxAI, repo lockdocs, workflow release.yml, no environment) to @sylphx/lockdocs and the five @sylphx/lockdocs-* natives. Merging does not publish (0.2.0 is released).
• One tagline ("Exact-version library docs from your lockfile — local, offline, no rate limits."), sourced from packages/lockdocs/package.json and checked by scripts/check-tagline.ts in CI against the README lead, docs hero and meta description, server.json, the crate description and the GitHub description.
• README benchmark table and library count are generated from docs/public/bench-results.json by bench/render.py; stale bench/results.json removed (the benchmarks page renders from the same file).
• Copy: offline wording states the one-time model download; Context7's lead on newest majors stated; "Also from Sylphx" adds readme-mark.
• Bumps folded in from Dependabot: actions/checkout v7, download-artifact v8, deploy-pages v5, dirs 7, sha2 0.11, toml_edit 0.25.