ci(npm): publish to npm on version tag (provenance) + release runbook

`bun/npm install -g opencodex` pulls from the npm registry, not GitHub — so the package
must be published. Add .github/workflows/publish-npm.yml: on a pushed tag vX.Y.Z (or
manual dispatch) it sets up bun (for the prepublishOnly GUI build) + node, verifies the
tag matches package.json, and runs `npm publish --provenance --access public`. Needs an
NPM_TOKEN repo secret. Release runbook in devlog/65_npm-publish-ci. Package already
publish-ready (npm pack: 54 files, ships gui/dist + bin, excludes dev dirs).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: lidge-jun

.github/workflows/publish-npm.yml

@@ -0,0 +1,58 @@
+name: Publish to npm
+
+# Publishes opencodex to the npm registry so `bun install -g opencodex` /
+# `npm install -g opencodex` work. Triggered by pushing a version tag (v1.2.3),
+# which `npm version` creates — or manually from the Actions tab.
+on:
+  push:
+    tags: ["v*.*.*"]
+  workflow_dispatch:
+
+# id-token: write enables npm provenance (supply-chain attestation from this CI run).
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: publish-npm
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # opencodex is bun-native (the `prepublishOnly` build runs under bun).
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      # node + npm do the actual publish (with provenance); registry-url wires NODE_AUTH_TOKEN.
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Install dependencies
+        run: bun install
+
+      # Guard: a pushed tag (v1.2.3) must match package.json "version" so we never
+      # publish a mismatched build.
+      - name: Verify tag matches package version
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          PKG=$(node -p "require('./package.json').version")
+          TAG="${GITHUB_REF_NAME#v}"
+          echo "package.json=$PKG  tag=$TAG"
+          test "$PKG" = "$TAG" || { echo "::error::tag v$TAG != package.json $PKG"; exit 1; }
+
+      # `npm publish` runs prepublishOnly (typecheck + build the GUI into gui/dist) first,
+      # so the published tarball always ships a fresh GUI. --access public for the unscoped name.
+      - name: Publish
+        run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

devlog/65_npm-publish-ci/00_plan.md

@@ -0,0 +1,41 @@
+# npm publish CI + release runbook
+
+## Why
+`bun install -g opencodex` / `npm install -g opencodex` install from the **npm registry**, NOT from
+GitHub. Pushing to GitHub does not make those commands work — opencodex must be **published to npm**
+first. This adds a GitHub Actions workflow that publishes on a version tag.
+
+## What shipped
+- `.github/workflows/publish-npm.yml` — on a pushed tag `vX.Y.Z` (or manual dispatch):
+  setup bun (for the `prepublishOnly` GUI build) + node (for `npm publish`), `bun install`, verify the
+  tag matches `package.json` version, then `npm publish --provenance --access public`.
+- Package was already made publish-ready (earlier `63_release-prep`):
+  `files` allowlist (src + gui/dist + scripts/postinstall.mjs + README + LICENSE), `bin` (opencodex/ocx,
+  `#!/usr/bin/env bun`), `engines.bun`, `prepublishOnly` (typecheck + build the GUI into gui/dist so the
+  published tarball always carries a fresh dashboard). `npm pack --dry-run`: 54 files / 634 KB, ships
+  gui/dist + the bin, excludes devlog/docs-site/gui-src.
+
+## One-time setup (owner)
+1. Create an npm **Automation** access token: npmjs.com → Access Tokens → Generate → *Automation*.
+2. Add it to the repo as a secret named **`NPM_TOKEN`**: GitHub → Settings → Secrets and variables →
+   Actions → New repository secret.
+3. (First publish only) the npm name `opencodex` is currently unclaimed, so the first tagged release
+   claims it under your npm account.
+
+## Releasing (each version)
+```bash
+# from a clean main
+npm version patch        # or minor/major — bumps package.json + creates the vX.Y.Z git tag
+git push --follow-tags   # pushes the commit AND the tag → CI publishes to npm (with provenance)
+```
+After the workflow goes green:
+```bash
+bun install -g opencodex     # or: npm install -g opencodex
+ocx init && ocx start
+```
+
+## Notes
+- opencodex is **bun-native** (the `ocx` bin is `#!/usr/bin/env bun` and the server uses `Bun.serve`),
+  so installers still need **bun** on PATH even via `npm install -g`. `engines.bun` documents this.
+- The consumer-side `postinstall` (interactive [Y/n] GitHub-star prompt) is TTY-gated → it no-ops in
+  CI / piped installs, so it never blocks an automated install.