Follow up on release asset attestation review findings #441

Source review: #434 (review)

PR: #434

The review approved the release asset attestation change, but identified two minor non-blocking follow-ups that should be tracked separately.

Follow-ups:

1. Update the stale npm version reference in docs/adr/0026-installation-and-distribution.md.

The review found that docs/adr/0026-installation-and-distribution.md still says the npm version is currently 2.0.0; the actual version is now 3.0.0. This drift was pre-existing, but it is near text edited by #434 and should be fixed.

Acceptance criteria:

• docs/adr/0026-installation-and-distribution.md reflects the current npm version, or the wording is made version-agnostic to avoid recurring drift.
• Documentation avoids making package-manager install behavior sound like it uses the baked release SHA when it does not.
• Run the relevant documentation checks for the changed ADR.

Security impact:

This is documentation and rollback hygiene. The source review concluded these findings do not affect the release attestation security posture and do not block #434.