Show why the package can be trusted before anyone switches #64

Switching means replacing a widely used dependency with a newer package from a smaller account, which looks like the pattern of npm supply-chain attacks. A newcomer should be able to dismiss that doubt in a minute.

Already true but not stated where newcomers look:

• every version is published from GitHub Actions with npm provenance through trusted publishing, staged, and made public only after a maintainer approves it with npm 2FA;
• no runtime dependencies, same Unlicense as Postgres.js;
• fix claims are backed by tests that fail on Postgres.js 3.4.9 and pass here ([FIXED in 4.0.0–4.4.0] Upstream reports fixed by those releases, now each reproduced by a test #61).

To do:

• README Security section: how it's published, npm audit signatures, no runtime dependencies or install scripts, a link to the changes since 3.4.9 (docs: restructure the README and move the API reference to docs/api.md #141)
• README: who maintains it, and where to see the provenance on npmjs.com (Trust signals: pinned actions, Scorecard, driver diff, README Security (#64) #147)
• a diff of src/ and types/ against Postgres.js 3.4.9, linked from the README: docs/changes-since-3.4.9.diff, regenerated by npm run diff:upstream and checked by the tag run (Trust signals: pinned actions, Scorecard, driver diff, README Security (#64) #147). The whole-repo compare view it replaces was 196 files; this is 12
• OpenSSF Scorecard workflow (Trust signals: pinned actions, Scorecard, driver diff, README Security (#64) #147); first score 6.3, the fixable checks are in Raise the OpenSSF Scorecard score from 6.3 #148
• score badges: none until a score reaches 90 (9 for Scorecard), tracked in Raise the OpenSSF Scorecard score from 6.3 #148
• check the package on Socket.dev: 4.5.1 has the same four package alerts as postgres 3.4.9 (network, debug, environment variable and filesystem access, all inherent to a driver) and no dependency alerts. Supply chain 81 against upstream's 99, maintenance 94 against 81, the rest 100. Nothing in the code to fix
• check @steadybrew/postgresjs-migrate on Socket.dev (score 76): one package alert, URL strings, for the link the CLI prints to Sentry users. The dependency alerts (shell, URL strings, AI-detected anomaly, dynamic require, environment variable and filesystem access) all come from @ast-grep/napi's generated napi-rs loader, which runs ldd --version to detect musl, reads /usr/bin/ldd, honours NAPI_RS_NATIVE_LIBRARY_PATH and requires the platform binary package. It has no install scripts. Removing them would mean replacing ast-grep with a pure JavaScript parser, not worth it for a tool run once through npx
• confirm the registry tarball runs no install scripts (no preinstall, install or postinstall; prepare doesn't run for registry installs); pin CI actions to SHAs, kept current by Dependabot (Trust signals: pinned actions, Scorecard, driver diff, README Security (#64) #147)
• protect main: ruleset main blocks force-pushes and deletion and requires linear history, for everyone including admins. Direct pushes stay allowed, so Scorecard will still flag the missing review requirement

Needed before the switching tool (#55) and any launch post, since both ask people to install the fork.

@steadybrew/postgresjs-migrate 0.1.0 was published by hand to create the package, so it has no provenance; versions from 0.1.1 on are staged by the migrate-v* tag run.