docs(auth): clarify Bazel package authority

[Jess Sullivan (Jesssullivan)]

Summary

• document that tinyland-auth is consumed as @tummycrypt/tinyland-auth while release authority is Bazel-first
• remove the stale npmjs publishConfig claim from package metadata
• add a package-authority Vitest guard covering repo-owned runner, Bazel targets, npmjs disabled mode, and GitHub Packages mirror naming
• declare docs/workflow metadata as Bazel test data so the guard passes under //:test

Validation

• pnpm install --frozen-lockfile
• pnpm test -- tests/package-authority.test.ts
• pnpm build
• pnpm check:package
• bazel test //:test
• bazel build //:pkg //:typecheck
• git diff --check