🐸 Versioned release

[bumpy-bot]

This PR was created and will be kept in sync by bumpy based on your bump files (in .bumpy/). Merge it when you are ready to release the packages listed below:

Minor releases

fledgling 1.2.1 → 1.3.0 _CHANGELOG.md

• Read npm's own NPM_CONFIG_OTP env var as a fallback for --otp, so a 2FA code supplied that way also suppresses the interactive browser-approval prompt instead of fledgling assuming it still needs one. Docs now lead with npm's browser flow — approving with a passkey or security key is how most people will do this, and npm is moving away from authenticator codes — with the --otp / --otp-secret options kept but framed as the legacy fallback. (bump file)
• publish: true|false replaces permissions. npm grants every trusted publisher staged publishing (npm stage) — a config created with --allow-publish alone reads back with both permissions. The only real choice is whether the publisher may also npm publish directly, so the config key is now a boolean ("publish": true, default) with --publish / --no-publish flags. The old permissions: publish | stage | both still works (stage → false, the rest → true) with a deprecation note, and fledgling init asks the yes/no question. sync no longer reports every package as out of sync over the implied createStagedPackage. (bump file)
  Failed trust reads are no longer reported as "not configured". sync and the wizard read each package's trust config with a captured npm trust list --json, which can't run npm's browser 2FA itself. When that read failed (no remembered 2FA approval), it was silently treated as an empty config — so sync claimed nothing was set up, and would happily offer to "fix" everything. Reads now distinguish a failure (EOTP etc.) from an empty config: sync probes right after npm's interactive approval (with a short retry for the registry's "remember for 5 minutes" grace to kick in) and stops with a clear message if the approval didn't stick; a read that fails mid-run is listed as "couldn't be read" and left alone; and the add/wizard flow fails that package instead of writing blind.
• New include config option: list exact package names that have no package.json in the workspace — e.g. per-platform native binary packages published as optional dependencies — and fledgling treats them like discovered packages (claimed, trusted, synced, tab-completed). They're npm-only; fledgling jsr skips them. (bump file)