feat: ship as npm package via @netresearch/agent-skill-coordinator (#3)

## Summary
- Adds `package.json` so the skill is npm-installable straight from this
GitHub repo (no npm-registry publication required to start).
- README gains a new **Installation** section with **Composer (PHP
Projects)** and **npm (Node Projects)** subsections, matching the rest
of the Netresearch skill collection. The previous README had no
Installation section at all.

## How discovery works (consumer side)

```bash
npm install --save-dev \
  @netresearch/agent-skill-coordinator \
  github:netresearch/peer-qa-review-skill
```

After install, the coordinator's `postinstall` walks `node_modules`,
finds this package via `aiAgentSkill: skills/peer-qa-review/SKILL.md`,
validates the frontmatter, and writes a `<skills_system>` block into the
project's `AGENTS.md`. Same shape as the Composer plugin's output.

## Why version stays at `0.0.0-source`

Versioning still lives in git tags and the existing Composer release
workflow. A real npm version would be set at publish time; until then,
`0.0.0-source` is the standard "this manifest exists for tooling, not as
a release marker" placeholder.

## Sibling PRs (merged)
- netresearch/git-workflow-skill#39
- netresearch/github-project-skill#67
- netresearch/security-audit-skill#67

Coordinator: https://github.com/netresearch/node-agent-skill-coordinator
(`@netresearch/agent-skill-coordinator@0.1.2`)

Author: CybotTM

README.md

@@ -19,6 +19,34 @@ The skill produces a **single structured QA comment** on the ticket with `(/) (x
 
 Agent Skill following the [open standard](https://agentskills.io). Works with Claude Code, and any other agent runtime that implements the spec.
 
+## Installation
+
+### Composer (PHP Projects)
+
+```bash
+composer require netresearch/peer-qa-review-skill
+```
+
+Requires [netresearch/composer-agent-skill-plugin](https://github.com/netresearch/composer-agent-skill-plugin).
+
+### npm (Node Projects)
+
+```bash
+npm install --save-dev \
+  @netresearch/agent-skill-coordinator \
+  github:netresearch/peer-qa-review-skill
+```
+
+Requires [@netresearch/agent-skill-coordinator](https://github.com/netresearch/node-agent-skill-coordinator), which discovers the skill in `node_modules` and registers it in `AGENTS.md` via a `postinstall` hook. For pnpm, also allowlist the coordinator's postinstall:
+
+```json
+{
+  "pnpm": {
+    "onlyBuiltDependencies": ["@netresearch/agent-skill-coordinator"]
+  }
+}
+```
+
 ## Companion skills (optional)
 
 - [`jira-communication`](https://github.com/netresearch/jira-skill) (public) — required for ticket I/O. The bundled `qa-gather.py` script is used in Stage 0.

package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@netresearch/peer-qa-review-skill",
+  "version": "0.0.0-source",
+  "description": "Round-1 IT QA peer-review runbook: lifecycle, checklist, severity vocabulary, comment template, edge cases, anti-patterns. Generic for any IT/Ops team.",
+  "license": "(MIT AND CC-BY-SA-4.0)",
+  "author": "Netresearch DTT GmbH (https://www.netresearch.de/)",
+  "homepage": "https://github.com/netresearch/peer-qa-review-skill",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/netresearch/peer-qa-review-skill.git"
+  },
+  "bugs": {
+    "url": "https://github.com/netresearch/peer-qa-review-skill/issues"
+  },
+  "keywords": [
+    "ai-agent-skill",
+    "peer-qa-review",
+    "it-qa",
+    "quality-assurance",
+    "anthropic",
+    "claude-code"
+  ],
+  "aiAgentSkill": "skills/peer-qa-review/SKILL.md",
+  "files": [
+    "skills/peer-qa-review/",
+    "LICENSE-MIT",
+    "LICENSE-CC-BY-SA-4.0",
+    "README.md"
+  ],
+  "peerDependencies": {
+    "@netresearch/agent-skill-coordinator": "^0.1"
+  }
+}