package: adopt the scoped npm identity without publishing

[WalksWithASwagger]

Summary

Adopt the approved scoped npm identity in package metadata and install documentation without publishing.

Context

• Blocked by build: align fresh-clone setup with the canonical verification gate #321 and security: enforce the approved keyframe repository and package boundary #323.
• Roadmap phase: Phase 1 - package readiness
• Relevant files: package.json, package-lock.json, README.md, and docs/SCOPE.md
• Current behavior: package metadata and install examples do not consistently express the intended public scoped identity.
• Desired behavior: metadata uses @walkswithaswagger/rafiki, while executable names and checkout-local commands remain stable and clearly distinguished.

Implementation Notes

• Change package identity only after the keyframe package boundary is settled.
• Preserve the rafiki executable and image-gen alias.
• Distinguish registry-install examples from checkout-local npx rafiki examples.
• Do not query credentials, publish, tag, release, or mutate registry state.

Acceptance Criteria

• Package identity is @walkswithaswagger/rafiki in metadata and lockfiles.
• Executable remains rafiki and the image-gen alias remains available.
• Registry installation examples use the scoped package name.
• Checkout-local npx rafiki examples remain valid and are labeled as checkout commands.
• Package boundary, doctor, docs, and tests pass.
• No publication, registry login, tag, or release occurs.

Tests/Evals

• Validate metadata and dry-run tarball shape only.
• Do not perform a global or registry installation.

Verification

• npm pack --dry-run --json
• npm run pack:check
• npm run doctor
• npm run docs:check
• npm test

Agent Instructions

• Use branch codex/issue-<this-issue>-scoped-package-identity.
• Do not start until build: align fresh-clone setup with the canonical verification gate #321 and security: enforce the approved keyframe repository and package boundary #323 are merged.
• Do not run npm publish, npm login, or create tags/releases.
• Keep prebuilt frontend packaging in the dependent issue.

Human Checkpoints

• Reverify npm scope ownership immediately before publication, not in this implementation issue.

Out of Scope

• Publishing any version.
• Bundling the React portal.
• Changing executable behavior or package version.
• Credential setup or rotation.

Linear

Not applicable. Rafiki delivery is GitHub-only; do not create or update a Linear issue.