Phase 1 + Phase 2 (npm scope) for issue #188: cargo-binstall + npm distribution

[sdairs]

Closes part of #188.

Adds two installation paths for clickhousectl so the obvious cargo binstall and npm install -g incantations work after the next tag. Brew, the shell installer, full cargo-dist migration, and PyPI (Phase 3) are intentionally not in this PR — they will follow.

Summary

Phase 1 — cargo-binstall + crates.io readiness

• release.yml builds now produce clickhousectl-{target}-v{version}.tar.gz archives, each containing a single directory of the same name with the clickhousectl binary inside (the cargo-binstall naming convention). Smoke-test job and install.sh updated to consume the new layout.
• New publish-crates job tags-trigger publishes both crates to crates.io. It is idempotent for clickhouse-cloud-api (skips when the version is already on crates.io) so the API client can lag behind clickhousectl version bumps.
• crates/clickhousectl/Cargo.toml gains description, license = "Apache-2.0", repository, homepage, keywords, categories, and an explicit [package.metadata.binstall] block.
• crates/clickhouse-cloud-api/Cargo.toml license corrected MIT → Apache-2.0 to match the repo LICENSE; same metadata fields added.
• README gets cargo binstall, cargo install clickhousectl, and direct-download sections.

Phase 2 (npm scope only)

• New npm/ wrapper package: bin/cli.js shim execs the binary that install.js downloads from the matching GitHub release at install time (single-package postinstall layout — simpler than dist's subpackage approach and decoupled from any future cargo-dist migration). Exposes both clickhousectl and chctl bin commands.
• New publish-npm job in release.yml: uses id-token: write for npm OIDC trusted publishing, runs npm publish --provenance --access public, and deliberately does not set NODE_AUTH_TOKEN (per npm docs, even an empty value short-circuits the OIDC flow).
• Pinned actions/setup-node@v6.4.0 by SHA to match the zizmor hardening style.

One-time manual setup before the next tag

• Add CARGO_REGISTRY_TOKEN repo secret for crates.io publishes.
• Squat clickhousectl on crates.io (first publish via cargo publish locally) and on npm (seed publish with a granular token).
• Configure the npm trusted publisher on npmjs.com pointing at ClickHouse/clickhousectl + release.yml + the publish-npm job; revoke the granular npm token once OIDC is wired.

Test plan

Most of this is workflow / packaging plumbing that only runs on a tag push, so the meaningful tests are:

• cargo metadata and cargo build --workspace succeed with the new manifests.
• cargo publish --dry-run -p clickhouse-cloud-api packages cleanly.
• npm pack --dry-run in npm/ produces a tarball with the expected 4 files.
• node --check passes for install.js and bin/cli.js.
• release.yml YAML parses; job graph is build → smoke-test → release → {publish-crates, publish-npm}.
• Verify on first tag push: archives match clickhousectl-{target}-v{version}.tar.gz, cargo binstall clickhousectl resolves from crates.io, npm install -g clickhousectl installs the binary on macOS + Linux.

🤖 Generated with Claude Code