[jamesyong-42]

The repository is now public, so npm releases can include provenance. Remove the private-repository provenance override and explicitly require attestations in the OIDC publish job.

Prepare @vibefield/rosetta-protocol@0.1.1 and @vibefield/rosetta-room@0.1.1 to activate and verify the trusted publishers. npm requires each new publisher to complete its first successful publish within two days; manual dry runs do not activate it. Update workspace references and the lockfile together. The package APIs and runtime files are unchanged.

The README now describes the public repository, provenance, publisher activation, and the applied main-branch protection policy. main requires an up-to-date CI passed check and a pull request, including for administrators.

Validation:

• All 7 required CI checks pass, including the full Rust suites on Linux and macOS and the complete npm/app checks.
• All 6 release guard tests pass.
• The exact npm-v0.1.1 tarballs pass clean-consumer ESM, NodeNext types, DOM-free entry point, and browser/CSS build checks.
• Compared with the published 0.1.0 artifacts, all 353 protocol and 434 room non-manifest files are byte-identical. Only package versions and the room's protocol dependency change.
• The resumed main CI and 0.1.0 release dry run both pass. The dry-run artifacts' SHA-512 checksums exactly match npm; its publish job was skipped as intended.

Merging this PR does not publish packages. After approval, tagging its main commit npm-v0.1.1 runs all CI and publishes both verified tarballs through OIDC with provenance.