ci: add automated npm publish workflow for CLI

[mgoldsborough]

Summary

• Adds GitHub Actions workflow to automatically publish @nimblebrain/mpak (CLI) to npm on cli-v* tags
• Mirrors the existing sdk-typescript-publish.yml pattern: verify job (lint, typecheck, test) → publish job (OIDC provenance)
• Builds full dependency chain (@nimblebrain/mpak...) to include schemas and SDK

Release workflow

# 1. Bump version in packages/cli/package.json
# 2. Commit and push
# 3. Tag and push
git tag cli-v0.2.1 && git push --tags

Test plan

• Verify workflow file is valid YAML and triggers only on cli-v* tags
• Confirm npm environment exists in repo settings (already used by SDK workflow)
• Test with a real tag after merge

[shwetank-dev]

Clean implementation. Correctly mirrors sdk-typescript-publish.yml with the right structure: tag trigger → verify → OIDC-provenance publish.

Two nitpicks, both pre-existing patterns in the codebase (same in the SDK workflow):

• Node version mismatch: verify runs on Node 22, publish builds on Node 24 — the artifact shipped to npm was never directly tested on the version it was built with.
• Rebuild without artifact sharing: publish rebuilds from scratch rather than consuming the verified artifact from verify. Negligible practical risk with tsup, but technically you're shipping a fresh build rather than the one that passed CI.

Neither is blocking. Both could be addressed in a follow-up cleanup of the SDK workflow too.

Approve.