Pick the npm package name #78

The project still has no npm identity of its own. This issue is the single place to decide it, because the decision blocks the first real npm release and touches more than a package.json field.

The facts

agent-bundle is taken. agent-bundle@0.1.2 exists on npm and belongs to an unrelated project (yujiachen-y/agent-bundle), described as a "CLI tool and framework for defining, developing, and shipping AI agent skills". The collision is not theoretical: the old root README literally told people to npm i agent-bundle, which installed that other package. That instruction was removed in #54, and the README now documents pkg.pr.new preview installs instead.

create-agent-bundle is unclaimed. Verified against the registry (404) while landing the scaffolder in #62. So the create-* half of the name is available today; the framework half is not.

Publishing is deferred, not blocked. pkg.pr.new is the interim release channel until a name lands (see docs/preview-packages.md), and every CI run publishes installable tarballs of agent-bundle, @agent-bundle/rsc-runtime, and create-agent-bundle. Nothing about the release pipeline is waiting on code.

Provenance is already pre-wired. #40 made pkg.pr.new the interim channel and pre-wired npm provenance, so the first real publish should not need release-plumbing work — only a name.

What a rename touches

1. Package names — agent-bundle, the @agent-bundle/* scope (@agent-bundle/rsc-runtime), and create-agent-bundle. The scope is the load-bearing part: a scope rename is wider than the root package rename.
2. The scaffolder's derived preview URLs — packages/create-agent-bundle/src/framework.ts derives the framework version from https://pkg.pr.new/ScriptedAlchemy/agent-bundle/agent-bundle@<sha>, which embeds both the package name and the repo slug. options.ts and index.ts carry the same assumption.
3. Docs — README.md, packages/agent-bundle/README.md, packages/rsc-runtime/README.md, and docs/preview-packages.md all hardcode install commands built from the name and slug.
4. The GitHub repo slug — every pkg.pr.new URL is pkg.pr.new/<owner>/<repo>/<package>@<sha>, so renaming the repo invalidates published preview URLs and the scaffolder's derivation at the same time.

Options worth weighing

• Keep the repo slug, publish everything under a new scope (e.g. @<scope>/agent-bundle + create-<name>). Smallest blast radius; the unscoped name stays lost.
• Pick a wholly new name and rename the repo too. Cleanest end state; invalidates existing preview URLs and needs a docs sweep.
• Negotiate/claim the existing agent-bundle name. Cheapest if it works, unlikely, and not something to plan around.

Definition of done

A chosen name, plus a follow-up issue or PR that lands it across the four surfaces above and cuts the first provenance-signed npm release.

Related: #50 (the RFC arc whose phases are complete), #53 (README unslop, where the wrong-package instruction was found), #62 (scaffolder, where create-agent-bundle availability was verified).