CLI: publish components (modulora publish)

[jal-co]

Publish a component from the CLI to the /r/@username/name registry endpoint.

Scope

• Read a local registry-item (shadcn shape) + files; validate against @modulora/spec.
• POST to the authenticated publish endpoint (reuses #22 publish server fn).
• Respect the creator distribution-channel preference (#28) — CLI publish is one channel.
• Version bump via Tegami (Milestone 0: publish/versioning via Tegami #5).

Acceptance criteria

• modulora publish uploads a valid component and it appears in the catalog + on the profile.
• Rejects invalid registry items with a clear error.
• Only the namespace owner can publish (server-enforced).

Area: CLI

[jal-co]

Shipped: modulora publish reads a local registry-item.json manifest, requires explicit policy acceptance, and publishes through POST /api/publish — a thin shell over the web editor's exact pipeline (publishCore): same validation, server-enforced namespace ownership, same curator review. Verified E2E from a bare directory through review to a digest-verified install. Tegami-driven versioning/changelogs remain on #5.