docs: record 0.1.0 release, registry install verification and nightly proof

docs/runtime-checks.md

@@ -6,6 +6,17 @@ password printed on stdout) in a temp fixture and asserts against the HTTP API.
 
 ## Verified
 
+- **Registry install by package name (1.10, 2026-10-14)**: `@haylan/opencode-pocock@0.1.0`
+  published to the Gitea npm registry by the dispatched `release` workflow (run 5684, success;
+  tag `v0.1.0` created, package linked to repo). Anonymous registry reads work (HTTP 200 without
+  auth). A clean fixture with `"plugins": ["@haylan/opencode-pocock"]` + scope registry in
+  `~/.npmrc` loads the plugin: `/api/plugin` shows
+  `source {type:"package", target:"@haylan/opencode-pocock", version:"0.1.0"}`,
+  `state.status "active"`; skills inject from the bun cache path
+  (`~/.cache/opencode/npm/@haylan/opencode-pocock@latest/.../skills/...`); `npx -y
+  @haylan/opencode-pocock init` installs the three agents (modes decode correctly).
+  Id collisions with a pre-existing global `~/.agents/skills` Matt Pocock install resolve to the
+  file-based copy (expected; a clean machine gets all 31 from the package).
 - **Plugin loads and activates** from a local directory entry (`plugins: ["<abs path>/dist"]`);
   `GET /api/plugin` shows `haylan.pocock` with `state.status: "active"`.
   - A **file** entry (`file://.../dist/index.js`) is IGNORED — local plugin entries must be