Complete external v1.0 public release gates

[BoSuY0]

EnvLint is locally release-ready, but the final public release gates are external to the current worktree.\n\nVerified local gates:\n- npm run release:check passes.\n- npm run publish:dry-run passes.\n- Clean tarball install works with npx envlint --version, init, and scan --format json.\n- Public GitHub repo exists: https://github.com/BoSuY0/EnvLint\n\nRemaining gates:\n- Fix GitHub Actions account billing lock. Current CI runs fail before job steps start with: The job was not started because your account is locked due to a billing issue.\n- Authenticate npm locally or configure NPM_TOKEN in GitHub Actions. Current local state: NPM_TOKEN is unset and npm whoami returns ENEEDAUTH.\n- Confirm npm package-name/account policy for envlint before actual publish.\n- Rerun GitHub-hosted CI successfully on main.\n- Run npm publish --provenance.\n- Create GitHub release and move v1 tag to the release commit.\n\nRelated CI runs:\n- https://github.com/BoSuY0/EnvLint/actions/runs/26827647393\n- https://github.com/BoSuY0/EnvLint/actions/runs/26827759933

[BoSuY0]

Current blocker audit as of 2026-06-02 14:53 UTC:\n\n- Latest CI runs still fail before job steps start because GitHub reports: 'The job was not started because your account is locked due to a billing issue.'\n- Latest run checked: https://github.com/BoSuY0/EnvLint/actions/runs/26827881431 at commit 287be63.\n- Local npm state remains unauthenticated: NPM_TOKEN is unset and npm whoami returns ENEEDAUTH.\n- npm view envlint returns an unpublished-package E404, but maintainer account/name-policy confirmation is still required before publishing.\n\nNext required human/external actions:\n1. Fix GitHub account billing so Actions jobs can start.\n2. Configure npm auth/NPM_TOKEN and confirm envlint package-name publish rights.\n3. Rerun CI on main.\n4. Publish with npm publish --provenance.\n5. Create the GitHub release and move v1 tag.