docs(release): record rc publication verification

TODO.md

@@ -25,8 +25,8 @@
   credentials, including idempotency and conservative uninstall checks.
 - [x] Perform and record a pre-release manual security review of installer paths,
   file ownership, configuration edits, and failure limitations.
-- [ ] Publish the `0.1.0-rc.1` tarball as a repository pre-release and verify the
-  direct installation URL from a clean project.
+- [x] Publish the `0.1.0-rc.1` tarball and SHA-256 as a repository pre-release;
+  install from its public URL in a clean project and verify the checksum.
 - [ ] Add provider-backed verification after confirming credentials and model
   usage budget with the user.
 - [ ] Decide whether to publish the package to npm; repository pre-releases do