Correct marketplace install and publishing documentation

[nicodes]

Refs aviorstudio/termcade-be#44

Documentation-only corrections of verified drift — no behavior changes.

What was wrong, and the proof

• Pinned install example (termcade add you/mygame@1.0.0 in docs/packaging.md): the current CLI rejects it — versions cannot be pinned (cli.go, proven by running the built binary: exit 1). Docs now describe unpinned newest-compatible resolution (ABI sent with resolve; registry picks the newest release the binary can run — internal/registry/client.go Resolve, termcade-be handleResolve).
• Direct-GitHub download claim: docs said add "downloads it straight from GitHub". Current client downloads from /v1/games/:author/:slug/download through the registry and refuses any package whose sha256 does not match the registry-attested digest (internal/registry/client.go Download; termcade-be handleDownload: "clients do not fetch from GitHub themselves"). Corrected.
• First-publish-claims-namespace (README + docs/packaging.md): termcade-be registry.claim refuses publishing under an unclaimed handle ("nobody has claimed the handle … claim it, or create an org that holds it, before publishing under it"; e2e expects 404/403). Docs now say publishing requires an already-claimed handle (signup username or org membership).
• README dev loop said termcade add puts your local build on the menu: control comparison against README's own command table and docs/sdk.md (termcade dev install build/mygame.tcade) plus the CLI's rejection of non-marketplace ids. Corrected to dev install.
• packaging.md said the registry sorts versions for "pinning, 'latest' and rollback": pinning and rollback do not exist (README: "There is no way to install an older version, and that is deliberate"). Corrected to newest-compatible resolution.

Validation

• Every command example in the touched docs checked against termcade help and the command implementations (signup, add, dev install, whoami, username, org new, sync, keys new, list, remove, publish).
• Route/behavior claims checked against internal/registry/client.go and termcade-be (server.go routes, publish.go, registry.go, e2e tests).
• Local gates green: gofmt -l ., go vet ./... ./sdk/..., go test -race -count=1 ./... ./sdk/..., GOWORK=off go build/vet, cross-compile of all five release targets.

One-layer stack via gh-stack. No production CD surface for this docs-only change.

[nicodes]

Review 1

No findings.

Residual test risk: Reviewed only the specified pinned one-commit diff (2 modified documentation files), using the head CLI/client code and backend route/service tests as controls. CI is reported successful; no commands or tests were run in this read-only review. Redaction: none.

Verdict: APPROVE

[nicodes]

Review 1 reply

No findings require changes. The residual risk is accepted: this is a documentation-only diff, the reviewer checked the modified claims against the current CLI/client and backend route/service controls, and the terminal head CI completed successfully. No additional gate is warranted for this layer.

Disposition: Review 1 is approving.