ci: automate Homebrew formula update on release, add npm provenance

docs: restructure CHANGELOG with versioned releases

- Split [Unreleased] into v0.1.0-alpha and v0.2.0-alpha
- Follow Keep a Changelog format (Added/Changed/Fixed/Security)
- v0.1.0-alpha: core engine
- v0.2.0-alpha: providers, connect, security hardening, performance

feat: add Homebrew formula update to /release skill

ci: fix trusted publisher workflow per npm docs

Trusted publishing requires npm CLI 11.5.1+ and Node 22.14.0+.
Switch to Node 24, remove manual OIDC exchange, let npm CLI
handle authentication automatically. Provenance is generated
by default when publishing via trusted publisher.

ci: manually exchange OIDC token for npm publish token

The npm CLI does not automatically exchange GitHub OIDC tokens
for npm auth. Fetch OIDC token from GitHub, exchange with npm's
OIDC endpoint, then use the resulting token for publish.

ci: fix OIDC trusted publisher auth for npm publish

Remove registry-url from setup-node to prevent empty auth token
overriding OIDC flow. Set registry via npm config instead.

chore: bump hookflare CLI to 0.0.2