chore(ci): switch npm to unscoped plumb-cli + enable in cargo-dist installers

[aram-devdocs]

Summary

• The @plumb npm scope was never reserved. Switch to publishing the unscoped plumb-cli package to the npm account associated with the repo's NPM_TOKEN secret. cargo-dist 0.28.0 emits an unscoped npm package when npm is in installers and npm-scope is left unset — the package name comes from the cargo package name (plumb-cli).
• dist-workspace.toml: add npm to installers; rewrite the npm comment block to describe the unscoped path and drop the @plumb prerequisite text.
• .github/workflows/install-smoke.yml: ungate the npm rows on ubuntu/macOS/windows; install command becomes npm install -g plumb-cli.
• Docs (README.md, docs/src/install.md, docs/src/introduction.md, docs/src/ci/release-prep.md): document the npm i -g plumb-cli install path; rewrite the release-prep "npm activation" section to record npm as wired (no scope reservation needed).
• Validators (tests/install-smoke-validate.sh, tests/release-security-validate.sh, tests/release-readiness-matrix-validate.sh) and the v0 release-readiness runbook: assert the new shape — npm ungated, install string plumb-cli, installers includes npm, npm-scope unset, and brew is the only remaining gated channel.
• .github/workflows/release.yml: header comment updated to describe the unscoped npm publish.

dist plan --tag v0.0.1 now lists plumb-cli-npm-package.tar.gz alongside the existing platform archives, installer scripts, and Homebrew formula.

just check and the full nextest suite (510 tests) pass locally.

Closes #52.

Test plan

• just check (all validators green, including the updated install-smoke / release-security / release-readiness asserts).
• cargo nextest run --workspace --all-features — 510 passed.
• dist plan --tag v0.0.1 --output-format=json includes plumb-cli-npm-package.tar.gz in artifacts.
• After merge: tag-driven publish run lights up the install-smoke npm legs on ubuntu/macOS/windows.
• After merge: smoke-test npm i -g plumb-cli against the published package.

🤖 Generated with Claude Code

[github-actions]

I have all the context needed. Here is the full review:

---

Code review summary

PR: #246 — chore(release): switch npm to unscoped plumb-cli + enable in cargo-dist installers
Author: chore/npm-unscoped-plumb-cli branch
Base: main (a9a2146)

---

Blockers

#	Severity	File	Line	Issue	Suggestion
—	—	—	—	None	—

No Rust source files changed. Zero blocker-class findings apply.

---

Warnings

#	Severity	File	Line	Issue	Suggestion
1	Warning	tests/release-security-validate.sh	238–278	The old section 6 verified that no active npm publish or npm-scope lines existed in the release workflow (belt-and-suspenders guard). The replacement removes that workflow-level grep entirely and relies on dist-workspace.toml shape checks only. If a future dist generate re-run emits an explicit npm publish step, there's no validator catching it.	Add a check: `grep -v '^\s*#' "$RELEASE_WORKFLOW"
2	Warning	docs/src/install.md	80–91	The npm section says the install script "verifies the platform archive's checksum before extracting it." This is cargo-dist's built-in behavior, not Plumb's, and it will be silently wrong if cargo-dist changes that behavior.	Qualify with "cargo-dist's install script" or link to cargo-dist docs.

---

Architecture compliance

• [✓] No new unsafe outside plumb-cdp
• [✓] No new unwrap / expect / panic! in library crates
• [✓] No new println! / eprintln! outside plumb-cli
• [✓] No new wall-clock or HashMap in observable-output paths
• [✓] No new todo! / unimplemented! / dbg!

No Rust code changed. All architecture invariants are vacuously satisfied.

---

Anti-pattern scan

Pattern	Status	Details
AI-flavored prose in docs/src/**	Clean	New install.md and introduction.md prose is factual and direct. No "dive in", "seamless", "leverage", etc.
Open-ended TODO without issue ref	Clean	No new TODO markers introduced.
#[allow(...)] without rationale	N/A	No Rust changes.
Exact-string grep assertions	Watch	Seven validation scripts use -Fq substring matches against workflow comment text. If those comments are reworded without updating the validators, the validators silently pass or fail erroneously. This is structural fragility inherited from the existing test style, not introduced here.

---

Internal consistency audit

All changed files were cross-checked for mutual consistency:

• dist-workspace.toml: installers = ["shell", "powershell", "npm"], npm-scope absent. ✓
• .github/workflows/install-smoke.yml: All three npm matrix entries flipped to gated: false; install command is npm install -g plumb-cli. ✓
• tests/install-smoke-validate.sh: Checks npm_gated -eq 0, count = 3, and npm install -g plumb-cli in the workflow. ✓
• tests/release-security-validate.sh: Checks npm-scope absent, npm in installer list, plumb-cli in install-smoke. String match at line 272–274 verified against actual file content — all three grep targets (install-smoke \brew` legs stay gated and the docs MUST NOT claim, ## npm activation for `plumb-cli`, Issue feat(release): @plumb npm org + @plumb/cli wrapper package #52 is wired in this repo state.) exist verbatim in docs/src/ci/release-prep.md` lines 16, 32, 34. ✓
• tests/release-readiness-matrix-validate.sh: New grep strings match the docs/runbooks/v0-release-readiness-spec.yaml change verbatim. ✓
• README.md, docs/src/install.md, docs/src/introduction.md: All consistently document npm i -g plumb-cli. ✓

---

Quality assessment

This is a CI/docs-only PR. No library or binary Rust code was touched. The change correctly promotes npm from a prep-only/gated channel to an active (non-gated) channel backed by cargo-dist's unscoped package emission, with NPM_TOKEN as the publish credential. The prose in the release-prep doc is appropriately hedged — it names the remaining open item (first tag-driven live verification) without overstating readiness. The validation scripts are updated atomically with the config changes they test.

The one genuine risk is that the npm publish path is untested until the first tagged release. This is acknowledged in docs/src/ci/release-prep.md:43–44 and is an acceptable pre-release state.

---

Scope check

• Changes match PR description: Yes — exclusively npm activation across dist config, CI workflow, smoke tests, and docs.
• Scope creep detected: None.

---

Verdict: APPROVE