docs(release): prepare documented release candidate

TODO.md

@@ -21,6 +21,10 @@
   array merge and precedence behavior.
 - [x] Install the package tarball into a clean project outside this repository;
   verify CLI idempotency and native agent discovery.
+- [x] Document how to install and verify a release-candidate tarball without
+  credentials, including idempotency and conservative uninstall checks.
+- [x] Perform and record a pre-release manual security review of installer paths,
+  file ownership, configuration edits, and failure limitations.
 - [ ] Add provider-backed verification after confirming credentials and model
   usage budget with the user.
 - [ ] Confirm repository/package names and decide whether to publish.