merge: fix/v0.20.3-trust-md-scope-routing-recipe (#7)

Doc-only fix; no per-branch Codex review (will be covered in
the pre-tag final review pass per v0.20.2 pattern).

Author: omerakben

docs/TRUST.md

@@ -92,20 +92,22 @@ All three land at the `v0.x stable` milestone. Until then, treat the alpha insta
 
 `@tuel/code-oz` is published on public npm under the `@tuel` scope. If your `~/.npmrc` (or a project-local `.npmrc`) registers a custom registry for the `@tuel` scope (for example, a private registry from a different `@tuel`-scoped package at a previous employer), `npm install -g @tuel/code-oz` routes to that registry instead of public npm. The install fails with a 404 or an authentication error, not with a useful "scope is overridden" message.
 
-Check your scope routing before installing. Because `npm install -g` is a global install, pass `-g` so user-level `.npmrc` masking is caught:
+Check your scope routing before installing:
 
 ```sh
-npm config get @tuel:registry -g
+npm config get @tuel:registry
 ```
 
 If the output is `undefined` (the npm CLI's literal string for an unconfigured key) the scope is not overridden. If the output is anything else and is not `https://registry.npmjs.org/`, the scope is overridden. Two options:
 
 1. Per-command override (preferred, leaves your config untouched):
 
    ```sh
-   npm install -g @tuel/code-oz --registry=https://registry.npmjs.org/
+   npm install -g @tuel/code-oz --@tuel:registry=https://registry.npmjs.org/
    ```
 
+   Use the `--@tuel:registry=` form, **not** `--registry=`. The plain `--registry=` flag sets npm's default registry, but a scope-specific `@tuel:registry` mapping in your `~/.npmrc` has higher precedence and wins; the `--@scope:registry=` form sets the scope-specific registry on the command line and overrides any `.npmrc` mapping. A project-local `.npmrc` override is not consulted by `npm install -g` in npm 11+, so the per-command flag is the reliable path.
+
 2. Remove the override if you no longer need it:
 
    ```sh