docs(release): record rc publication verification

docs/IMPLEMENTATION-PLAN.md

@@ -139,7 +139,7 @@ provider-backed agent delegation and skill behavior remain unverified.
 runtime; config collisions are handled or reported before writes; the V2 plugin
 and its custom tool are confirmed active.
 
-### Phase 5 — Document and release (repository pre-release in progress)
+### Phase 5 — Document and release (repository pre-release published)
 
 - Document scope, installation, update/uninstall, compatibility, provenance,
   and known limitations.
@@ -151,9 +151,10 @@ pre-release tarball, as well as updating and uninstalling. A manual pre-release
 review of installer paths, ownership, JSONC edits, symlinks, and failure behavior
 found no release blocker for trusted project-local use; filesystem and
 provider-backed limitations are recorded in [`SECURITY-REVIEW.md`](SECURITY-REVIEW.md).
-Typecheck, all 16 tests, coverage (87.4% lines), and package dry-run passed.
-The `0.1.0-rc.1` tarball and repository release still need publication and a
-clean-project install check.
+Typecheck, all 16 tests, coverage (87.4% lines), and package build passed. The
+`v0.1.0-rc.1` pre-release and SHA-256 sidecar are published. A clean project
+installed the package using the public release URL, and the downloaded tarball
+matched its recorded SHA-256.
 
 **Acceptance:** another user can install from documented instructions and
 verify the deterministic behavior without credentials.