ci: add release.yml for npm Trusted Publishing (OIDC)

Publishes @mcptoolshop/loadout-os (packages/cli) on a v* tag via OIDC trusted publishing + provenance, and creates the GitHub Release. Adapted from the npm-placeholder template for this npm monorepo: publishes the packages/cli workspace member, tag-vs-version check against packages/cli/package.json, npm ci/build/test at root. NOTE: the CLI depends on the unpublished workspace packages claude-memories + claude-rules — those must be published (multi-repo-publish-sequencing) or bundled before the first real publish. Pairs with the v0.0.0 placeholder reserve + TP config (user-run, needs npm auth/OTP).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mcp-tool-shop

.github/workflows/release.yml

@@ -0,0 +1,80 @@
+name: Release
+
+on:
+  push:
+    tags: ['v*']
+
+permissions:
+  contents: write       # for GitHub Release creation
+  id-token: write       # for npm provenance via Sigstore OIDC
+
+jobs:
+  release:
+    name: Publish to npm + GitHub Release
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
+        with:
+          node-version: '22'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install npm >=11.5 in sandbox for OIDC trusted-publishing auth
+        run: |
+          # Node 22's bundled npm 10.9 races on an in-place 'npm i -g npm@latest'
+          # (MODULE_NOT_FOUND: promise-retry). Install npm@latest into a sandbox
+          # dir and shadow the system npm via PATH instead.
+          SANDBOX="$HOME/.npm-cli-sandbox"
+          mkdir -p "$SANDBOX"
+          pushd "$SANDBOX" >/dev/null
+          echo '{"name":"npm-cli-sandbox","version":"0.0.0","private":true}' > package.json
+          npm install --no-save --no-audit --no-fund --silent npm@latest
+          popd >/dev/null
+          echo "$SANDBOX/node_modules/.bin" >> "$GITHUB_PATH"
+          "$SANDBOX/node_modules/.bin/npm" --version
+
+      - name: Verify tag matches packages/cli/package.json version
+        run: |
+          PKG_VERSION=$(node -p "require('./packages/cli/package.json').version")
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          echo "Tag: ${GITHUB_REF_NAME} -> ${TAG_VERSION}"
+          echo "Package (packages/cli): ${PKG_VERSION}"
+          if [ "${PKG_VERSION}" != "${TAG_VERSION}" ]; then
+            echo "::error::Tag ${TAG_VERSION} does not match packages/cli/package.json version ${PKG_VERSION}"
+            exit 1
+          fi
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build (kernel -> memories -> rules -> cli)
+        run: npm run build
+
+      - name: Test
+        run: npm test
+
+      - name: npm pack dry-run (verify shape)
+        run: npm pack --dry-run -w packages/cli
+
+      # NOTE (Phase 6): @mcptoolshop/loadout-os depends on the workspace packages
+      # @mcptoolshop/claude-memories + @mcptoolshop/claude-rules, which are NOT yet
+      # published. Before the first real publish, either publish those deps (see
+      # multi-repo-publish-sequencing) or bundle/inline them. Until then this
+      # publish step would produce an install-broken package.
+      - name: Publish to npm with provenance (OIDC trusted publisher)
+        run: npm publish -w packages/cli --provenance --access public
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${GITHUB_REF_NAME}" \
+            --title "loadout-os ${GITHUB_REF_NAME}" \
+            --generate-notes \
+            --verify-tag