fix(cli): correct the package README, which said the package was unpublished (0.5.2)

packages/cli/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog — `@workspacejson/cli`
 
+## 0.5.2
+
+### Patch Changes
+
+- **Fixed:** the package README told readers the package was not published.
+
+  `README.md` is listed in `files`, so it ships in the tarball and renders on the
+  npm package page. It still carried the pre-release notice — "Not yet published.
+  This package is not on npm… Do not document `npm install @workspacejson/cli` as
+  if it works" — which meant the page for a published package advised against
+  installing it and pointed at `agents-audit` instead.
+
+  Replaced with real install instructions, a note that releases carry npm
+  provenance, and a migration table for anyone arriving from `agents-audit`: the
+  binary is renamed, there is no `scan`, and `.agentsauditrc` is not read.
+
+  Documentation only; no code change.
+
 ## 0.5.1
 
 ### Patch Changes

packages/cli/README.md

@@ -4,10 +4,26 @@ The **workspace.json producer**. Scans a repository and generates
 `.agents/workspace.json` deterministically, preserving human-authored `manual`
 evidence across regenerations.
 
-> **Not yet published.** This package is not on npm. Until the coordinated
-> publish-authority cutover, the working public command is
-> `npx agents-audit generate`, which runs this same producer implementation.
-> Do not document `npm install @workspacejson/cli` as if it works.
+## Install
+
+```bash
+npm install -g @workspacejson/cli   # or: npx @workspacejson/cli generate
+```
+
+Requires Node.js >= 20. Published from
+[`workspacejson/cli`](https://github.com/workspacejson/cli) with
+[npm provenance](https://docs.npmjs.com/generating-provenance-statements), so
+every release is traceable to the workflow run and commit that built it.
+
+> **Migrating from `agents-audit`?** That package is frozen at `0.4.4` and this
+> one continues its version line from `0.5.0`. The producer is the same
+> implementation, but the surface is deliberately smaller:
+>
+> | `agents-audit` | `@workspacejson/cli` |
+> | -- | -- |
+> | `agents-audit generate` | `workspacejson generate` |
+> | `agents-audit scan` | no equivalent — this is the producer, not the audit |
+> | `.agentsauditrc` | not read; a neutral config file is still to be named |
 
 ## Commands
 

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workspacejson/cli",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "The workspace.json producer — scans a repository and generates .agents/workspace.json deterministically, preserving human-authored manual evidence.",
   "license": "Apache-2.0",
   "author": "workspace.json contributors",