docs(release): confirm npm token revocation — credential hygiene fully closed, @loop-engine family TP-only · loopengine/loop-engine@bd6efd2