Publish to npm so it installs without cloning

[karava]

Make devflow installable via npm i -g … (and runnable on other machines) instead of only through a local clone + npm link. Deferred — npm link covers local dev/testing for now.

Why

• Install on another machine or let someone try it without cloning the repo.
• Standard distribution + versioned releases.

What's involved (mostly one-time)

1. npm account + npm login.
2. Name: devflow is almost certainly taken on the public registry — publish under our scope as @atrivolabs/devflow (the binary stays devflow). Update the name field in package.json.
3. Scoped packages are private by default → first publish needs npm publish --access public.
4. Add "prepublishOnly": "pnpm build" so we never ship a stale/missing dist/.
5. Sanity-check package.json: bin (devflow → ./dist/cli.js), files: ["dist"], engines.node, repository, license — all already present.

Release flow (per release)

npm version patch   # 0.1.0 -> 0.1.1, commits + tags
npm publish

• Hard rule: can't republish the same version — always bump.

Does NOT affect iteration

• Local dev keeps using pnpm build + npm link. Publishing is a separate, occasional release step.

Optional automation (nice-to-have)

• GitHub Action that runs npm publish on a pushed version tag (v*), using an NPM_TOKEN repo secret — so releases are hands-off. Requires CI to run pnpm build first.

Acceptance

• npm i -g @atrivolabs/devflow installs a working devflow command on a clean machine.
• prepublishOnly build wired up.
• (Optional) tag-triggered publish workflow.