docs: jpkg-guide — document default @lisp registry and bare-name resolution

ober

e583982403215f8ad9f542e03b781d24da680801

diff --git a/docs/jpkg-guide.md b/docs/jpkg-guide.md
index 3d0d495..719d4c6 100644
--- a/docs/jpkg-guide.md
+++ b/docs/jpkg-guide.md
@@ -100,6 +100,29 @@ jpkg verify me-demo-0.1.0.jpkg
 jpkg verify --reproduce      # prints the deterministic artifact digest
 ```
 
+### Installing from the public @lisp registry
+
+The multicall binary ships with a built-in default registry pointing at
+the public @lisp TUF mirror on GitHub Pages. On first use, jpkg syncs
+the registry metadata into `$JERBOA_PKG_HOME/registries/lisp/` so the
+full TUF verification chain (root → targets → release.json) runs over
+local files; package blobs (.jpkg) are fetched on demand during install.
+
+```sh
+mkdir app && cd app
+jpkg init @me/app
+jpkg add jerboa-ssh          # bare names auto-resolve to @lisp/jerboa-ssh
+# write code that (import (jerboa-ssh api))
+jerboa app.ss                # just works — no env wrapper needed
+```
+
+Bare package names (without `@scope/`) are auto-prefixed with the
+default scope `@lisp`. Override with `JPKG_DEFAULT_SCOPE=@other`, or
+always use the explicit form `jpkg add @lisp/jerboa-ssh`.
+
+Suppress the built-in default with `JPKG_NO_DEFAULT_REGISTRY=1` (e.g.
+to enforce that only your own registries are visible).
+
 Scaffold a fresh package with source and docs:
 
 ```sh