docs(npm): fix the scoped-package wire contracts in S11 and plan

Context

Live testing with the real npm CLI (the e2e harness in !867 (merged)) found two S11-prescribed behaviors that break scoped packages against real clients. The implementation faithfully follows the spec in both cases, so these are spec defects, the same class as the packument _rev gap (!861 (merged)/!863 (merged)):

• Publish: S11 publish Step 1 required the scope-stripped _attachments key, but libnpmpublish (npm, pnpm; the spec's own de-facto wire reference) keys the attachment by manifest.name verbatim, so every scoped publish failed with 400 publish_envelope_invalid.
• Install: the dist.tarball URL carried the scoped name with a raw slash, which the single-segment {package_name} download route can never match, so every scoped install 404'd on the tarball GET.

Changes

• Publish Step 1, the example envelope, and the shape-invalid AC now prescribe the full-name {name}-{version}.tgz key.
• Packument generation and its AC now prescribe the percent-encoded name in dist.tarball (@scope%2Fpkg), the form the routes resolve. The stored npm_files.file_name keeps the scope-stripped form in both cases.
• Plan Step 23 updated to describe the npm e2e harness as built (bash script plus the conformance:npm:s3-garage job; the development_stubs tag never existed, and Node was already pinned in .tool-versions), and the Status table records !867 (merged).

The implementation fix is stacked on this MR (!869 (merged)); the e2e harness MR (!867 (merged)) adds real-CLI scoped coverage on top.

Related to #143 (closed)