Distribute up via npm with trusted publishing

Makes the repository publish-ready for npm. The up package name on npm now belongs to this project; npm is where a JS-ecosystem CLI is expected to live (npm i -g up, npx up), and the previous curl | sh channel is frozen at its final beta.

Changes

• packages/cli/package.json — rename @vercel-labs/up → up; version 2.0.0 (the npm name's earlier 1.x line was an unrelated project, so the major jump signals the break and keeps ^1 consumers untouched); remove "private": true (it blocks publishing); add "files": ["dist"] — without it npm falls back to .gitignore, which excludes dist/, and the published tarball would ship without the CLI.
• .github/workflows/release.yml — id-token: write permission, registry-url, and a guarded publish step using npm trusted publishing (OIDC: no token exists; provenance is attached automatically). The guard publishes only when the pushed tag is exactly v<package.json version> — a suffixed tag can never publish a stable version — and prerelease versions (containing -) publish under the beta dist-tag so latest always resolves to a stable build.
• README.md, packages/cli/README.md (the npm package page), SECURITY.md, landing — install via npm install -g up; release verification is provenance-based (npm audit signatures) instead of CDN checksums.
• apps/downloads/public/install.sh — keeps working, frozen at v0.1.0-beta.5, and prints a pointer to npm. Existing release artifacts are untouched (CI enforces their immutability).

Package contents verified with npm pack --dry-run: LICENSE, README.md, dist/cli.js, package.json — 190 kB packed.

Rollout order

1. Trusted publishing for the npm package up must be configured to accept this repo's release.yml (owner-side; in progress).
2. Merge this PR. Note: the landing starts advertising npm i -g up when its deploy completes, so —
3. Tag the merge commit v2.0.0 and push the tag promptly. release.yml validates, builds, publishes to npm with provenance, and creates the GitHub Release.
4. Verify: npm install -g up && up --help, and npm audit signatures in a project that depends on it.

This PR publishes nothing by itself — publishing only happens when a v2.0.0 tag is pushed after merge.

Verification

Lint, typecheck, and build green; tests 156/158 (the 2 failures are pre-existing and occur only when running as root — identical on main); release-artifact verifier and installer syntax checks pass; lockfile unchanged by the rename.

Generated by Claude Code