Release npm CLI 1.10.26

[rudijetson]

Summary

• release @learnrudi/cli@1.10.26
• remediate moderate/high production dependency advisories
• add main-only npm OIDC trusted publishing with automatic provenance
• publish the exact verified tarball without a post-verification lifecycle rebuild

Verification

• pnpm test: 777/777
• release contract: 6/6
• pnpm build: pass and reproducible generated output
• production audit: zero known vulnerabilities
• repository and RUDI debt scans: zero findings
• isolated tarball install/version/help/audit: pass
• independent Standards/Spec/Proof confirmation: pass

Release gates

• merge only after required checks pass
• configure the npm trusted publisher for learnrudi/cli and publish-npm.yml
• dispatch the workflow from accepted main for version 1.10.26
• verify npm provenance, registry metadata, and both workstation installs

Rollback

npm versions are immutable. If promotion fails before publication, do not publish. If a defect is discovered after publication, correct the latest tag if needed, deprecate the affected version, and issue a new patch release.