Three gates before your first npm publish: 2FA, provenance, and staged releases

I published a small plugin to npm for the first time last week. It is a DeepSeek Harness plugin...