feat(cli)!: os package publish defaults visibility to org (ADR-0007 ②) (#1700)

A freshly published package should be auto-visible/installable across the
owner organization's environments — that's the common "build an app, deploy it
to my envs" case. Default `--visibility` private → org. Publishers opt into
narrower `private` (grant/ACL) or public `marketplace` explicitly.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

packages/cli/src/commands/package/publish.ts

@@ -165,9 +165,13 @@ export default class PackagePublish extends Command {
       description: 'Marketplace category slug (e.g. crm, hr, devtools)',
     }),
     visibility: Flags.string({
-      description: 'Who can see / install this package',
+      description:
+        "Who can see / install this package. " +
+        "'org' (default): auto-visible/installable across your organization's environments. " +
+        "'private': only explicitly-granted orgs/envs. " +
+        "'marketplace': public after review.",
       options: ['private', 'org', 'marketplace'],
-      default: 'private',
+      default: 'org',
     }),
     org: Flags.string({
       description: 'owner_org_id (required when using a bearer key in service mode; ignored in user mode)',