TypeScript SDK v0.1.0: public npm release and release readiness #1394

Summary

Publish @stacklok/mecatl-sdk@0.1.0 as the first public npm registry
release.

Version 0.0.1 remains the GitHub Packages preview. The 0.1.0 release
uses a new version and one canonical npm registry. No 0.0.x artifact is
republished or promoted.

This issue owns the remaining work required for the public release. The SDK
prototype and GitHub Packages delivery remain completed under #761 and #821.

Required work

• Complete HTTP steer and cancel-steer support (feat(server): add HTTP POST /v1/sessions/{id}/steer (mirroring approve/cancel) #873).
• Make the daemon-restart SDK test deterministic (test(sdk): make daemon-restart activity E2E wait for lease release #1386).
• Publish task-oriented TypeScript SDK documentation (Document TypeScript SDK workflows under Building #1391).
• Generate the TypeScript SDK method reference (Autogenerate TypeScript SDK method reference #1392).
• Make stacklok/mecatl public before publication.
• Confirm publish rights for the npm @stacklok-oss organization.
• Configure npm trusted publishing for stacklok/mecatl and
  .github/workflows/release-sdk-typescript.yml.
• Resolve the packed-source license requirements recorded in ADR 0304.
• Confirm that no long-lived NPM_TOKEN exists at repository,
  environment, or organization scope.
• Change the package version and canonical registry to npm for 0.1.0
  and later.
• Update installation documentation to remove the GitHub Packages
  authentication requirement.
• Run the complete release verification workflow against the exact
  packed artifact.
• Create sdk/typescript/v0.1.0 from the reviewed commit on main.
• Verify the published package, integrity, provenance, and public install.

Completion criteria

This issue is complete when:

• @stacklok/mecatl-sdk@0.1.0 installs from the public npm registry without
  GitHub authentication.
• The npm package contains the inspected release artifact and provenance.
• Browser HTTP steer matches the supported Node/Bun control behavior.
• SDK documentation covers the supported workflows and generated API.
• The release, browser, declaration, compatibility, and offline test gates
  pass.
• The GitHub Packages preview remains separate from the npm release line.

Independent follow-ups

The following work does not block v0.1.0:

• SDK: ship a fake-transport testkit for consumer-side mocking #872: downstream application mocking testkit.
• redisstore: isolated bounded follow pool + store-owned follower lifecycle #876: Redis follower capacity and lifecycle.
• SDK: spawn-and-connect (singleton daemon) mode for Node clients #1350: singleton local daemon mode.
• SDK mocking testkit: operationalize ecosystem-wide slot-in #877: integration of the mocking testkit with the wider frontend ecosystem.
• Slack bot development, tracked under Slack bot integration roadmap #1395.

References

• TypeScript SDK for mecatl (browser + Node) #761: original TypeScript SDK proposal.
• Prototype @stacklok/mecatl-sdk TypeScript SDK #821: completed SDK implementation plan.
• ADR 0304: public SDK and npm release contract.
• ADR 0313: interim GitHub Packages distribution.

Fully or partially written by an AI agent.