chore(ci): pack the npm libraries while the CLI builds - #56075

Stacked on #56074 (publish-setup-trims) (5bcc04e, "chore(ci): skip release-only setup on dev publishes"). The bottom of the stack is #55987. Draft: publish.yml cannot run on a pull request, so the first dev push after merge is the real test.

Summary

Publish builds the 14 npm libraries one by one before each npm publish. This PR moves that build into a new pack-npm job that runs alongside the CLI build. Publish then only publishes the finished tarballs, in the same order.

• pack-npm (needs version, skipped on beta): same version rewrite and bun install as publish, runs the 14 library scripts with OPENCODE_NPM_PACK_DIR, verifies and uploads npm-libraries. contents: read only, no secrets.
• Library scripts: with OPENCODE_NPM_PACK_DIR, build and copy the tarball. With OPENCODE_NPM_TARBALLS, keep npm view, then publish the carried tarball. With neither, unchanged.
• script/publish.ts: checks all 14 tarball names and versions before any release step. The version rewrite moved verbatim to script/release-files.ts.
• publish job: needs pack-npm, downloads the artifact (not on beta). The CLI stays in publish, because AUR hashes its local tgz.

Expected effect

Estimates, inferred from run logs:

• About 127 s of build leaves publish (38536124977, 38856436871), or about 206 to 212 s on slower runners (38785024495, 38814116264).
• The publish step drops from 5m24s to about 3m20s on a dev push, 6m09s to about 4m05s on a release.
• The whole run saves about 2.1 minutes, if pack-npm (about 2.5 to 4.5 minutes) ends before build-node-cli, the signing jobs and build-electron. In both reference dev pushes it would. Otherwise only the overlap is saved.

Evidence

• Both jobs use the same commit, version, lockfile, Bun 1.4.2, runner label and script order.
• bun pm pack is deterministic; ten libraries should match in-place builds byte for byte. core, server, sdk and client chunk in filesystem listing order, which already differs between runs today (38814116264 vs 38856436871). Fixing that changes published output, so it is a separate PR.
• Locally, two full pack passes gave identical sha256s and left no tracked file modified. verify and carried handle wrong, missing and misnamed tarballs.
• Not run: any publish script, or script/pack-npm.ts end to end.
• actionlint, typecheck, lint, Prettier and a frozen-lockfile install pass.

Things to know

• Trade: a library typecheck, ui test or codemode smoke-install failure now skips all of publish. On dev pushes this also holds back that push's CLI. On releases it prevents today's partial release.
• Re-runs: "Re-run failed jobs" keeps the version and artifacts. "Re-run all jobs" packs a new version.
• New libraries in NpmLibraries.names need a converted script, or pack-npm fails.
• Beta merge:
  • script/publish.ts: beta's plugin-genui is a separate hunk; no conflict expected.
  • publish.yml: the new needs, download step and env line conflict with the rest of the stack.
  • A beta workflow_dispatch with a bump now stops at verify before publishing, instead of possibly publishing libraries as latest. So the variable stays unconditional.
• Unchanged: dist-tags and provenance.

Verification

Rollback is a revert of this commit.

What to review:

• With no variables, every library script behaves as before.
• The pack path never reaches npm publish; the carried path keeps npm view and respects --dry-run.
• NpmLibraries.names matches script/publish.ts, minus cli, in order.
• verify runs before the first release side effect.
• script/release-files.ts is a verbatim move.
• pack-npm permissions and conditions; all paths use /tmp/npm-libraries.
• You accept both trades.

On the first dev push, check:

• pack-npm logs verified 14 npm library tarballs; the artifact holds 14 .tgz files, about 5 MB.
• Each Shasum: in pack-npm equals its npm notice shasum: in publish.
• pack-npm ends before build-node-cli and the signing jobs.
• Publish library sections show no build output; cli is unchanged.
• File counts match the previous dev publish.
• The publish step takes about 3m20s.

On the first release: the same, plus the desktop dry-run after verify, and commits with only version and lockfile changes.