feat!: publish as @dsh-plugin/session-delete with an automated Gitea npm release

The registry owner is the scope the package must publish under, so the name moves from @local/ to @dsh-plugin/ in all three places that must agree: package.json, cordis.patch.yml, and the client module id. `private` goes away because npm refuses to publish such a package, and publishConfig pins the registry to this organization's npm endpoint.

The tag workflow publishes whatever version the pushed v* tag names, using the built-in Gitea job token, and refuses a tag that disagrees with package.json.

package.json

@@ -1,10 +1,17 @@
 {
-  "name": "@local/dsh-session-delete",
+  "name": "@dsh-plugin/session-delete",
   "version": "1.0.0",
-  "private": true,
   "description": "Permanently delete a conversation: stop it, remove its session log, subagent logs, and spilled tool output, and drop every registry reference. Settings → General can sweep orphaned temporary files left by conversations that are gone.",
   "type": "module",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitea.iwake.top/dsh-plugin/session-delete.git"
+  },
+  "homepage": "https://gitea.iwake.top/dsh-plugin/session-delete",
+  "publishConfig": {
+    "registry": "https://gitea.iwake.top/api/packages/dsh-plugin/npm/"
+  },
   "exports": {
     ".": "./index.js",
     "./client": "./client.js",