chore: prepare ZEVM for npm prerelease

[roninjin10]

What changed

• chooses 0.1.0-beta.1 as the first honest prerelease and keeps every package/native ABI version aligned
• pins Zig 0.15.2, Rust 1.89.0, Node 22.22.0, publishing Node 24.11.1/npm 11.6.2, and Bun 1.4.0
• adds install/usage/release docs plus npm repository, homepage, license, engine, and provenance metadata
• adds a tag-gated release workflow that verifies merged-to-main tags, builds/tests, builds nine native packages, and publishes platform packages before @evmts/zevm
• hardens release helpers: all artifacts and versions are required, local non-dry publishing is rejected, prereleases use the beta dist-tag, and generated package licenses are staged
• fixes the npm-smoke build graph race so the smoke command waits for zevm.node
• removes the two FreeBSD package claims because the pinned Voltaire build fails those targets with error: unsupported Rust target OS

Publish target and version

npm is the correct primary target because Tevm consumes npm/zevm as @evmts/zevm, and the runtime selects native Node-API addons from optional platform packages. npm view zevm returned E404 (bare name available), while npm view @evmts/zevm returned the existing 0.0.0; keeping the established @evmts scope preserves package identity and org ownership. 0.1.0-beta.1 signals a real pre-1.0 release without asserting API stability.

Verification run locally

Toolchain used: Zig 0.15.2, rustc/cargo 1.89.0, Node 26.5.0/npm 11.17.0 for the full run. Node 22.22.0 was separately used for TypeScript typechecking and loading the native binding, which returned node22-native=0.1.0-beta.1. Publishing npm 11.6.2 separately completed npm ci successfully.

zig build --summary all
Build Summary: 10/10 steps succeeded

zig build test --summary all
Build Summary: 23/23 steps succeeded; 545/545 tests passed

zig build c-smoke --summary all
Build Summary: 14/14 steps succeeded
c-smoke success

zig build npm-smoke --summary all
ok
Build Summary: 10/10 steps succeeded
npm-smoke success

zig build npm-platform-artifacts -Doptimize=ReleaseSafe --summary all
Build Summary: 9/9 steps succeeded
npm-platform-artifacts success

node npm/zevm/scripts/smoke.cjs zig-out/npm/prebuilds/darwin-arm64/zevm.node
ok
version=0.1.0-beta.1

npm --prefix npm/zevm ci --ignore-scripts
added 40 packages, and audited 41 packages
found 0 vulnerabilities

npm --prefix npm/zevm run verify:release -- v0.1.0-beta.1
release metadata ok: @evmts/zevm@0.1.0-beta.1, tag=v0.1.0-beta.1, nativePackages=9

npm --prefix npm/zevm run typecheck
(exit 0)

npm --prefix npm/zevm run build
(exit 0; ESM and CJS emitted)

actionlint .github/workflows/ci.yml .github/workflows/release.yml
(exit 0)

The first core test run after the exact requested non-recursive clone reported 541/545 tests passing because lib/execution-apis was not initialized. After git submodule update --init --depth 1 lib/execution-apis (now documented), the same suite passed 545/545. No test result is being hidden.

Human actions before release

1. Create and protect a GitHub npm environment with required reviewers. Add an NPM_TOKEN environment secret authorized to publish the @evmts scope for the initial publication of the five not-yet-created native package names. The local npm credential is invalid and this repository currently has no Actions secrets/environment.
2. After the initial CI publication creates all packages, configure npm trusted publishing for evmts/zevm and .github/workflows/release.yml on all ten npm packages, then remove/rotate the bootstrap token.
3. Connect a docs deployment to zevm.tevm.sh; DNS reaches Vercel today but responds DEPLOYMENT_NOT_FOUND (HTTP 404).
4. Merge only after review, then create/push the annotated tag v0.1.0-beta.1 from the merged commit to trigger publishing. Do not publish from a workstation.
5. Update Tevm's pinned ZEVM commit only after this PR/release is validated; this PR does not touch the live Tevm checkout.

Honest limitations

• The nine-OS/architecture release matrix is wired but intentionally was not triggered, because a v* tag is the irreversible human release trigger. The local native build/smoke covered darwin-arm64; the other matrix jobs will gate publishing.
• FreeBSD is not advertised in this prerelease. Restoring it requires a pinned Voltaire revision whose Rust target mapping supports FreeBSD, followed by native package CI coverage.

[roninjin10]

Follow-up from CI and full qualification:

• The first PR run failed during recursive checkout because the superproject pointed lib/hive at deleted upstream commit 0baff346... (upload-pack: not our ref). Commit 5f9c53e restores the reachable, previously documented/verified Hive pin c37a9a26873ea74a084d59f035d57cb1fe20a0eb. A complete recursive submodule initialization now succeeds locally.
• zig build qualification-check -- --require-covered passes: 21 records, 21 covered, 0 explicit gaps, 0 blocked.
• zig build verify --summary all honestly does not pass: core remains 545/545 tests passed, but external fixture #18072, stStaticFlagEnabled/CallWithZeroValueToPrecompileFromCalledContract :: Berlin post=0, returns actual root 0xc08a...f708 instead of expected 0xfff1...23f2 and exits UnexpectedState after 18,071 preceding external cases succeeded.
• The tag release workflow now runs the required qualification check and zig build verify before any native package is published. Therefore this external conformance regression blocks the human release trigger instead of allowing an inaccurately green publication.

Docker is not running in this environment, so bun tools/hive_rpc_compat_smoke.ts was not claimed locally; tag CI still carries that existing job. The core suite/build/native/package results in the PR description remain accurate.