feat: publish Regex Tools 0.1.0

docs/RELEASE.md

@@ -0,0 +1,23 @@
+# Release process
+
+1. Ensure the intended commit is clean and tagged.
+2. Install the exact lockfile with `npm ci`.
+3. Run `npm run release:artifact`.
+4. Record the reported SHA-256, then run
+   `npm run package:release -- --force` twice and verify both reported digests
+   match it. Inspect an existing exact-version artifact before deliberately
+   replacing it.
+5. Inspect ZIP paths, manifest, legal documents and absence of maps/secrets.
+6. Publish ZIP and `.sha256` on the matching Gitea release.
+7. Use the public immutable URL and digest in Toolbox Portal.
+
+The package script sorts paths without locale-dependent collation, rejects
+symlinks and credential-like paths, normalizes file timestamps and modes,
+verifies manifest/source identity, stages both outputs and rolls back the pair
+on publication failure, replaces an existing exact version only with
+`--force`, and produces:
+
+```text
+release/regex-tools-0.1.0.zip
+release/regex-tools-0.1.0.zip.sha256
+```