Document consuming the registry #163

User story / Problem statement

A consumer has no instructions. The README describes building the DAR and
running the service out of a working copy; nothing tells a downstream repository
how to depend on this one, what to put in its manifest, what environment the
service needs, where those values come from, or that a private repository means
the install needs git credentials. Separately, several documents describe an
install lifecycle and a CI pipeline that this epic changes, and a document that
is confidently wrong is worse than one that is silent.

Expected outcome

A reader outside this repository can add one dependency line, run one command,
and know exactly which environment variables to set and where their values come
from. A reader inside it finds no sentence that this epic falsified.

Acceptance criteria

Consumer documentation

• The README carries a section giving the dependency line pinned at a tag,
  the pnpm exec invocation, the full required and optional environment, and
  a pointer to where the template ids and admin party come from
• It states the git-credentials precondition and why it exists
• Every command in that section has been run literally as written

Internal documentation

• The command tables in CLAUDE.md and ARCHITECTURE.md carry the two new
  commands
• CLAUDE.md's CI paragraph and SPEC.md's pull-request-coverage bullet
  describe three checks, not two
• SPEC.md's repository layout lists both new scripts
• SPEC.md's version references say 0.2.0 and distinguish the npm
  consumption tag from the DAR release tag
• SPEC.md's size figures are re-derived, and the sentence names what it
  counts

Verification

• The counting words in every edited paragraph (both, every, all,
  only, and the numerals) are re-read against the tree, not only the facts
  underneath them
• Every path the new prose names exists
• The diff contains only .md files

Technical notes

• A documentation change has no mutation check and no suite that could detect a
  defect, so git diff --stat showing only .md files is a stronger argument
  than a green test run. Say that plainly rather than letting a green summary
  imply a suite verified anything.
• SPEC.md is written for an external audience evaluating the implementation,
  not for someone installing it, so the consumer instructions belong in the
  README. What SPEC.md needs is the version, the third CI check, the two new
  scripts, and the size figures.
• SPEC.md's TypeScript size figures are already stale before this work
  starts. It says 1724 service and 4343 test lines; the tree gives 1738 and
  4349. The service figure was find registry/src -name '*.ts' | xargs wc -l when
  it was written and has drifted since; the test figure matches no method that
  reproduces. Restate both with the command that produced them, rather than
  adjusting the old numbers by the delta.
• The four optional environment variables are read as env.PORT and friends
  rather than through the required-variable helper, so they never appear as
  quoted string literals in the config source. A cross-check of the README's list
  against those literals will show exactly four differences, and any fifth is a
  real gap.
• Two tags will exist and mean different things: the DAR is published at one, the
  npm package is consumed at another. Say which is which rather than leaving a
  reader to infer it.