Publish package to the npm registry so `npx claude-code-privacy-guard rules` works

[fahadsiddiqui]

Problem

The README documents npx claude-code-privacy-guard rules as the way to launch the local rules-management web UI, but the package has never been published to the npm registry:

$ npm view claude-code-privacy-guard
npm error code E404
npm error 404 Not Found - GET https://registry.npmjs.org/claude-code-privacy-guard

scripts/release.sh used to have an npm publish step at the end of the release flow, but it was intentionally removed in 0f747a0 ("we are not publishing to npm yet, ... to avoid an accidental publish"). Today the package is only distributed via the Claude Code plugin marketplace (/plugin marketplace add + /plugin install), which does not put claude-code-privacy-guard anywhere npx can resolve it. So the documented npx ... command currently 404s for any user who tries it outside of a plugin install.

Proposal

Migrate distribution so the package is actually published to npm, and re-add a safe publish step to the release flow:

• Reserve/verify the claude-code-privacy-guard name is available on npmjs.com
• Add required npm publish metadata to package.json (repository, homepage, bugs, publishConfig if scoping is needed, confirm files/bin are already correct - they look right today)
• Decide on npm 2FA / automation token strategy for publishing (local npm publish vs. CI-based publish on tag push)
• Re-add a guarded npm publish step to scripts/release.sh (or move publishing into a GitHub Actions workflow triggered by the gh release create step already in place)
• Publish an initial version and confirm npx claude-code-privacy-guard rules works standalone (i.e. without the Claude Code plugin installed)
• Update README if the install/usage instructions need to change once the package is live on npm

Why this matters

The plugin marketplace install and the npm registry are two different distribution channels. Right now only the former exists, but the README promises the latter (npx claude-code-privacy-guard rules). Either publish to npm or adjust the docs to stop implying it's available - publishing is the better outcome since it also lets non-Claude-Code users run the rules UI directly.