Pin public access in the manifest

[tosinamuda]

A scoped package defaults to restricted, so @latentic/live-markdown's
visibility depended on whoever published remembering --access public on
the command line.

Forget it once and the package goes private. On a free account that fails
loudly; on a paid one it succeeds quietly and every consumer gets a 404 —
which is roughly what we spent ten minutes chasing after the first
publish, before the registry read path caught up.

publishConfig moves that decision into the file, where it is reviewed
like any other change. It sits beside files, the other field governing
what a publish sends.

Verified rather than assumed: bumping the version locally and running
npm publish --dry-run with no flag reports

npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access

[tosinamuda]

Landed — in the package's own repository, which is where that manifest now lives.

This pinned publishConfig.access in packages/rich-editor/package.json. The editor left Compose for getlatentic/live-markdown while this was open, and this commit came across with the git subtree split, so the setting is shipping today:

$ npm view @latentic/live-markdown@0.1.1 publishConfig
{ access: 'public' }

It does its job there — publish.yml runs a bare npm publish with no --access flag, and the manifest supplies it. Which was the argument for putting it in the manifest rather than the command line in the first place.

Merging it here would add three lines to a directory #183 removes, so closing instead of merging. Nothing is lost.