ci: add GitHub Actions workflow to publish CLI to npm on cli-v* tags

Author: Jing-yilin

.github/workflows/publish-cli.yml

@@ -0,0 +1,64 @@
+name: Publish CLI to npm
+
+on:
+  push:
+    tags:
+      - 'cli-v*'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: cli
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Verify binary
+        run: |
+          head -1 dist/index.js | grep -q "#!/usr/bin/env node"
+          node dist/index.js --version
+
+      - name: Publish to npm
+        run: npm publish --access public --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Create GitHub Release
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          VERSION="${GITHUB_REF#refs/tags/cli-v}"
+          gh release create "$GITHUB_REF_NAME" \
+            --title "shader-cli v${VERSION}" \
+            --notes "## Install
+
+          \`\`\`bash
+          npm i -g @resciencelab/shader-cli@${VERSION}
+          \`\`\`
+
+          Or use without install:
+          \`\`\`bash
+          npx @resciencelab/shader-cli@${VERSION}
+          \`\`\`" \
+            --repo "$GITHUB_REPOSITORY"