publish.yml: wire 2.0 cutover release flow with platform packages (#362)

* publish.yml: wire 2.0 cutover release flow with platform packages

Restructure the release pipeline for the 2.0 cutover (epic #240):

- Convert cli-build.yml + napi-build.yml to reusable workflows so the
  publish workflow can dispatch them via `uses:`. Drops the stub publish
  jobs that lived inside each.
- Update publish.yml to ship 11 npm packages in lockstep:
  - 3 TS-only umbrellas (relayburn, @relayburn/sdk napi umbrella, @relayburn/mcp)
  - 4 prebuilt CLI platform packages (@relayburn/cli-<short>)
  - 4 prebuilt SDK napi platform packages (@relayburn/sdk-<short>)
- Drop the 5 retiring TS packages (reader, ledger, analyze, ingest, cli)
  from the publish loop. Their source dirs stay (cli-golden + conformance
  fixture seeder still consume them); deprecation is a manual post-cutover
  step.
- New publish job downloads artifacts from the build-cli + build-sdk
  reusable workflows and stages them into per-platform package dirs
  before pack/publish: `burn` binary → `packages/relayburn/npm/<short>/bin/`,
  `relayburn-sdk.<short>.node` → `packages/sdk-node/npm/<short>/`.
- Use `npm pack` for non-workspace packages (umbrellas + platform packages
  live outside the pnpm workspace per pnpm-workspace.yaml's excludes);
  keep `pnpm pack` for `@relayburn/mcp` so workspace:* gets rewritten.
- Publish order: platform packages → umbrellas, so post-publish
  `npm install relayburn` (or `@relayburn/sdk`) can resolve all four
  optionalDependencies immediately.
- Tag scheme: `<key>-v<ver>` per npm target (e.g. `relayburn-v2.0.0`,
  `cli-darwin-arm64-v2.0.0`). Canonical release tag is `relayburn-v<ver>`,
  used by create-release. crates.io tags `relayburn-{sdk,cli}-v<ver>`
  emitted once per run.
- Sync optionalDependencies on both umbrellas (`relayburn` for cli-*,
  `@relayburn/sdk` napi umbrella for sdk-*) at bump time.
- Skip changelog generation for platform packages (they're implementation
  detail tracking the umbrella version); umbrellas + mcp keep the
  hand-curated `[Unreleased]` → `[x.y.z] - DATE` promotion.

Also: extend `.gitignore` to cover staged napi `.node` files in
per-platform sdk-node directories, and trim the verify-publish package
choices to the post-cutover three (relayburn, @relayburn/sdk, @relayburn/mcp).

* publish.yml: fix CLI artifact download path to match upload-artifact@v4 hierarchy

CodeRabbit (PR #362 review) flagged that upload-artifact@v4 preserves the
full directory structure for single-file uploads, so the CLI binary lands
at /tmp/cli-artifacts/relayburn-cli-<short>/packages/relayburn/npm/<short>/bin/burn
rather than the artifact root. The previous cli_src path would never resolve
at staging time, halting the publish run on the first matrix leg.

The SDK leg is unaffected because it uploads via a glob (packages/sdk-node/src/*.node),
and globs strip the path up to the first wildcard.

Author: willwashburn

.github/workflows/cli-build.yml

@@ -1,9 +1,9 @@
 name: cli build
 
 # Build prebuilt `burn` binaries for every platform we publish to npm under
-# `@relayburn/cli-*`. PRs validate the matrix; tags / manual dispatch *would*
-# publish, but the publish step is stubbed off for now — the cutover publish
-# workflow integration lands as a follow-up to this PR.
+# `@relayburn/cli-*`. PRs validate the matrix; the cutover publish workflow
+# (`.github/workflows/publish.yml`) calls this workflow via `workflow_call`
+# to produce the binaries it then stages into per-platform packages.
 #
 # Mirrors `.github/workflows/napi-build.yml`: the napi-rs SDK uses the same
 # umbrella + per-platform-package shape, just with `.node` artifacts instead
@@ -30,11 +30,11 @@ on:
       - 'packages/relayburn/**'
       - '.github/workflows/cli-build.yml'
   workflow_dispatch:
-    inputs:
-      publish:
-        description: 'Publish prebuilt artifacts to npm under the `next` tag (stubbed; full wiring lands with the cutover publish workflow)'
-        type: boolean
-        default: false
+  workflow_call:
+    # Publish runs the same matrix this workflow exercises on PRs. The
+    # caller downloads the uploaded `relayburn-cli-<short>` artifacts and
+    # stages them into `packages/relayburn/npm/<short>/bin/` before
+    # `npm pack` + `npm publish`.
 
 permissions:
   contents: read
@@ -169,31 +169,3 @@ jobs:
             ./packages/relayburn
           NODE_PATH="$smoke_dir/node_modules" "$umbrella_dir/node_modules/.bin/burn" --help
           NODE_PATH="$smoke_dir/node_modules" "$umbrella_dir/node_modules/.bin/burn" --version
-
-  publish:
-    # Stub. Real publish wiring lands as a follow-up that integrates with
-    # `.github/workflows/publish.yml`: download the matrix artifacts, drop
-    # each into the right `packages/relayburn/npm/<short>/bin/` directory,
-    # and `npm publish` the umbrella + each per-platform package via OIDC
-    # trusted publisher. Until then, calling `workflow_dispatch` with
-    # `publish: true` exercises the artifact download path so we catch
-    # wiring errors early without actually pushing to npm.
-    needs: build
-    if: github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Download all artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: packages/relayburn/npm-artifacts
-
-      - name: Inspect artifacts (publish stub)
-        run: |
-          echo 'Publish step is currently a stub. Full wiring lands in the cutover publish.yml integration follow-up.'
-          ls -lahR packages/relayburn/npm-artifacts || true

.github/workflows/napi-build.yml

@@ -1,9 +1,10 @@
 name: napi build
 
 # Build prebuilt napi-rs `.node` artifacts for every platform we publish to
-# npm under `@relayburn/sdk-*`. PRs validate the matrix; tags / manual
-# dispatch *would* publish, but the publish step is stubbed off for now —
-# wired up properly in #249 (cutover release workflow).
+# npm under `@relayburn/sdk-*`. PRs validate the matrix; the cutover publish
+# workflow (`.github/workflows/publish.yml`) calls this workflow via
+# `workflow_call` to produce the `.node` files it then stages into
+# per-platform packages.
 #
 # Caches Cargo registry + git + target dir, plus pnpm store, so the matrix
 # stays fast on the hot path.
@@ -29,11 +30,11 @@ on:
       - 'rust-toolchain.toml'
       - '.github/workflows/napi-build.yml'
   workflow_dispatch:
-    inputs:
-      publish:
-        description: 'Publish prebuilt artifacts to npm under the `next` tag (stubbed; full wiring in #249)'
-        type: boolean
-        default: false
+  workflow_call:
+    # Publish runs the same matrix this workflow exercises on PRs. The
+    # caller downloads the uploaded `relayburn-sdk-<short>` artifacts and
+    # stages them into `packages/sdk-node/npm/<short>/` before
+    # `npm pack` + `npm publish`.
 
 permissions:
   contents: read
@@ -220,40 +221,3 @@ jobs:
         env:
           RELAYBURN_SDK_NAPI_BUILT: '1'
         run: node --test 'test/conformance.test.js'
-
-  publish:
-    # Stub. Real publish wiring lands in #249 (Wave 3 cutover) — at that
-    # point this job downloads the matrix artifacts, drops each into the
-    # right `npm/<platform>/` directory, and runs `npm publish --tag=next`
-    # for the umbrella + each per-platform package via OIDC trusted
-    # publisher. Until then, calling `workflow_dispatch` with
-    # `publish: true` exercises the artifact download path so we catch
-    # wiring errors early without actually pushing to npm.
-    needs: build
-    if: github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v5
-
-      - name: Setup Node
-        uses: actions/setup-node@v6
-        with:
-          node-version: '22.14.0'
-          cache: 'pnpm'
-
-      - name: Download all artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: packages/sdk-node/artifacts
-
-      - name: Inspect artifacts (publish stub)
-        run: |
-          echo 'Publish step is currently a stub. Full wiring lands in #249.'
-          ls -lah packages/sdk-node/artifacts || true