Add GitHub Actions CI and npm release workflows

CI builds and smoke-tests the CLI on Node 18/20/22 for pushes and PRs to
main. Release publishes to npm with provenance and creates a GitHub Release
when a vX.Y.Z tag is pushed; it verifies the tag matches package.json first.
Requires an NPM_TOKEN automation-token secret.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: pratiksahu

.github/workflows/ci.yml

@@ -0,0 +1,28 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [18, 20, 22]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      - name: Smoke test the built CLI
+        run: |
+          node dist/cli.js --version
+          node dist/cli.js --list --no-color > /dev/null
+          printf 'y\nn\n' | node dist/cli.js quick --no-detect --no-save --no-color > /dev/null

.github/workflows/release.yml

@@ -0,0 +1,59 @@
+name: Release
+
+# Publishes to npm when a version tag (e.g. v0.2.1) is pushed.
+#
+# Setup (one time):
+#   1. Create an npm "Automation" access token for the @geekyants org
+#      (npmjs.com → Access Tokens → Generate → Automation). Automation tokens
+#      bypass 2FA/OTP, which is what lets CI publish unattended.
+#   2. Add it as a repo secret named NPM_TOKEN
+#      (Settings → Secrets and variables → Actions → New repository secret).
+#
+# Cut a release:
+#   npm version patch   # bumps package.json + creates a vX.Y.Z commit & tag
+#   git push --follow-tags
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write # create the GitHub Release
+  id-token: write # npm provenance (public package + public repo)
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          registry-url: "https://registry.npmjs.org"
+          cache: npm
+
+      - name: Verify tag matches package.json version
+        run: |
+          PKG_VERSION="$(node -p "require('./package.json').version")"
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          echo "package.json: $PKG_VERSION | tag: $TAG_VERSION"
+          if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
+            echo "::error::Tag $GITHUB_REF_NAME does not match package.json version $PKG_VERSION"
+            exit 1
+          fi
+
+      - run: npm ci
+
+      - run: npm run build
+
+      - name: Publish to npm
+        run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Create GitHub Release
+        run: gh release create "$GITHUB_REF_NAME" --title "$GITHUB_REF_NAME" --generate-notes
+        env:
+          GH_TOKEN: ${{ github.token }}