docs: record 0.1.0 release, registry install verification and nightly proof

TODO.md

@@ -32,8 +32,11 @@ State: `.opencode/state/status.md`. Design: `docs/architecture.md`.
 - [x] 1.8 .gitea/workflows/: check.yml, nightly.yml, smoke.yml (dispatch); scripts/smoke.ts —
       PASS on v2.0.29 (plugin active, 31 skills, 16 hidden, agents + permissions decoded)
 - [x] 1.9 local runtime verification → docs/runtime-checks.md (findings folded into README/AGENTS)
-- [ ] 1.10 manual release 0.1.0 to Gitea registry; verify install-from-registry by package name
-- [ ] ask repo admin to add Gitea secret PACKAGE_TOKEN (write:package + write:repository)
+- [x] 1.10 manual release 0.1.0 to Gitea registry (dispatch run 5684, tag v0.1.0, package linked);
+      install-from-registry verified in clean fixture (plugin active as package source, npx init
+      works, anonymous registry reads) → docs/runtime-checks.md
+- [x] ask repo admin to add Gitea secret PACKAGE_TOKEN — done 2026-10-14; nightly dispatch run
+      5685 proved runner github.com access + no-change early exit
 
 ## Phase 2 — conversion
 
@@ -59,10 +62,9 @@ State: `.opencode/state/status.md`. Design: `docs/architecture.md`.
 - ~~Slash exposure for injected skills~~ RESOLVED: none (runtime check 2026-10-14); README
   documents file-based alternatives.
 - Package name/scope: CONFIRMED `@haylan/opencode-pocock` (owner, 2026-10-14).
-- Does nightly runner have network access to github.com for upstream fetch? (1.8 — fallback: mirror
-  upstream to Gitea and sync from the mirror.) Verify on first nightly run.
-- Install-from-registry by package name (npm-name plugin entry resolving through `exports`) —
-  verify at 1.10; local dir entry verified.
+- ~~Does nightly runner have network access to github.com for upstream fetch?~~ VERIFIED
+  2026-10-14: nightly dispatch run 5685 success (clone + no-change early exit).
+- ~~Install-from-registry by package name~~ VERIFIED 2026-10-14 (see docs/runtime-checks.md).
 
 ## Done log