docs: list all 13 instance methods in README API TOC; publish with --provenance

[kurok]

Summary

Fixes #109 — two documentation/artifact drifts from the 2026-07-02 repository audit.

1. The README API TOC listed only 5 of the 13 documented instance methods, hiding the entire KV v2/metadata surface from readers who trust the TOC. The TOC is now 1:1 with the documented API: delete, update, request, deleteVersions, undeleteVersions, destroyVersions, readMetadata and deleteMetadata each got a full API entry (anchor, description, kind, normalized parameter table) in the existing jsdoc2md style, and the per-method return contract is now stated up front: read()/list() resolve to a Lease, every other data-plane method resolves to the raw parsed Vault response body.
2. CONTRIBUTING.md documents the release as npm publish --provenance --access public and publish.yml already requests id-token: write for OIDC — but the actual publish command never passed --provenance, so no provenance attestation was generated. The workflow now passes --provenance, matching the documented claim.

Note for maintainers (from the issue checklist): please confirm npm trusted publishing / granular token setup for node-vault-client on npmjs.com before the next release — with --provenance the publish now fails loudly if OIDC is unavailable, and the provenance badge on the next published version verifies the end-to-end claim.

Changes

• README.md
  • API TOC: added the 8 missing instance methods, ordered to match the document
  • new API entries for delete, update, request, deleteVersions, undeleteVersions, destroyVersions, readMetadata, deleteMetadata
  • added a Return contract note (Lease vs raw parsed body) after the TOC
  • added the missing <a name="VaultClient+fillNodeConfig"></a> anchor the TOC already linked to
  • constructor options table: added api.kv.autoDetect / api.engines rows (cross-linked to the KV v2 section); fixed the options.logger row (stray extra cell, wrong default) and the missing string type on write()'s path param
  • AWS IAM example: moved namespace to its canonical api.namespace location (auth.config.namespace remains documented as the legacy fallback)
• .github/workflows/publish.yml: npm publish --access public → npm publish --provenance --access public (the job already has permissions: id-token: write)

Type of change

• Bug fix
• New feature
• Refactor
• Documentation
• CI / tooling

Checklist

• Tests added or updated — n/a, docs + workflow flag only
• npm run lint && npm test passes locally (lint clean; test:unit 255 passing)
• User-facing changes recorded under # Unreleased in CHANGELOG.md — n/a, no package behavior change
• All commits have a Signed-off-by: trailer (git commit -s)

Verification

• All 42 in-page README fragment links checked programmatically against explicit <a name> anchors and GitHub heading slugs — all resolve
• publish.yml validated with python3 -c "import yaml; yaml.safe_load(...)"