fix: README.md

Author: jay

README.md

@@ -7,21 +7,20 @@ patches. The server binds to `127.0.0.1` and keeps backups under
 
 ## Usage
 
-Published to the public npm registry — no login, no token, no registry
-configuration:
+GitHub Packages requires authentication even when consuming a public package.
+Point the `@deckflow` scope at GitHub Packages and log in with a GitHub personal
+access token (classic) that has `read:packages` permission:
 
 ```bash
-npx @deckflow/html-editor ./index.html
+npm config set @deckflow:registry https://npm.pkg.github.com
+npm login --scope=@deckflow --auth-type=legacy --registry=https://npm.pkg.github.com
 ```
 
-> Earlier versions were published to GitHub Packages, which requires a token
-> even to read a public package. If you configured `@deckflow:registry` for
-> that, remove it — it will otherwise shadow this package and every other
-> `@deckflow` one:
->
-> ```bash
-> npm config delete @deckflow:registry
-> ```
+Then run the package directly:
+
+```bash
+npx @deckflow/html-editor ./index.html
+```
 
 ## Global CLI
 
@@ -213,13 +212,12 @@ editable, but changing their grid safely requires a span-aware table model.
 
 Publishing is handled by [`.github/workflows/publish.yml`](.github/workflows/publish.yml).
 Creating a GitHub Release runs the test suite, checks the package contents, and
-publishes the matching version to the public npm registry with provenance. A
+publishes the matching version to GitHub Packages. A
 release tagged `v0.1.1` (or `0.1.1`) must therefore contain `"version":
 "0.1.1"` in `package.json`.
 
-The workflow needs one repository secret, `NPM_TOKEN` — an npm automation token
-with publish rights on the `@deckflow` scope. The built-in `GITHUB_TOKEN`
-cannot publish to npmjs; it only ever authenticated against GitHub Packages.
+The workflow grants `packages: write` to the repository's built-in
+`GITHUB_TOKEN`, so no npm token or additional Actions secret is required.
 
 A normal patch release can be prepared with: