Releases are cut by tagging the repository, for example v0.1.0, following
semantic versioning. Consumers upgrade by moving their pinned tag. Release tags
are never rewritten.
If the package later needs semver ranges or changelog-driven upgrades, the
intended path is publishing to a registry and dropping "private": true.