docs(library): the first npm release is published by hand

A trusted publisher can only be added to a package that already exists on
npm, so the setup section now starts with the manual first publish.

Author: settings-as-code-release

docs/reference/library.md

@@ -149,4 +149,4 @@ The package and the action share one version, the one in `.release-please-manife
 
 ## One-time publishing setup
 
-For the owner, once, on npmjs.com: on the package's settings page, add a trusted publisher of type GitHub Actions with owner `Vivswan`, repository `github-settings-as-code`, workflow filename `ci.yml`, and no environment. Then, under publishing access, choose "Require two-factor authentication and disallow tokens", so the workflow's OIDC identity is the only thing that can publish.
+For the owner, once. npm adds a trusted publisher only to a package that already exists, so the first version is published by hand from a maintainer machine with two-factor authentication: `bun run build:lib` first (the tarball ships `lib/pkg/`, which is built, not committed), then `npm publish --access public`. Then, on npmjs.com, on the package's settings page, add a trusted publisher of type GitHub Actions with owner `Vivswan`, repository `github-settings-as-code`, workflow filename `ci.yml`, and no environment. Then, under publishing access, choose "Require two-factor authentication and disallow tokens", so the workflow's OIDC identity is the only thing that can publish.