ci: move build-cli to dedicated workflow triggered on release published

Separates binary building from the release job so it triggers via
on.release.published rather than on.push (which was blocked by
paths-ignore: .github/**). Removes the build-cli job from release.yml.

https://claude.ai/code/session_01AvbVaZPypGVUyzNuZ4AtWi

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: mrsimpson

.github/workflows/build-cli.yml

@@ -0,0 +1,60 @@
+name: Build CLI Binaries
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: write
+
+jobs:
+  build-cli:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.release.tag_name }}
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9.15.9
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '22'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install
+
+      - name: Build project
+        run: |
+          pnpm add @rollup/rollup-linux-x64-gnu --save-dev || echo "Failed to install Rollup platform dependency"
+          pnpm run build
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.24'
+
+      - name: Install clihub
+        run: go install github.com/thellimist/clihub@latest
+
+      - name: Generate workflows CLI binaries
+        run: |
+          export PATH="$(go env GOPATH)/bin:$PATH"
+          clihub generate \
+            --stdio "node packages/cli/dist/index.js" \
+            --name workflows \
+            --platform linux/amd64,darwin/arm64,darwin/amd64,windows/amd64
+
+      - name: Upload binaries to GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ github.event.release.tag_name }}
+          files: out/**
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}