Shadscan release

Ship one new @shadscan/cli version to npm with its changelog entries and verification. Prereleases (0.1.0-rc.N) publish under the npm next tag; stable releases publish under latest through the staged GitHub workflow.

Before acting, read docs/releasing.md in full — it is the source of truth for owner prerequisites, gates, trusted publishing, and recovery. Keep this skill as the executable coordinator; never weaken or skip the runbook's gates.

Completion contract