feat: add npm publishing support

[neiii]

Summary

• Adds npm installer support via cargo-dist
• Publishes bridle-ai package on releases
• Documents NPM_TOKEN setup in CONTRIBUTING.md

Changes

• dist-workspace.toml: Added npm to installers and publish-jobs, set npm-package = "bridle-ai"
• .github/workflows/release.yml: Added publish-npm job that downloads artifacts and runs npm publish
• CONTRIBUTING.md: Documented NPM_TOKEN secret setup

Before merging

Ensure NPM_TOKEN secret is configured in GitHub repo settings.

[greptile-apps]

Greptile Summary

This PR adds npm publishing support for the bridle-ai package and comprehensive Copilot CLI harness support. The npm publishing is configured through cargo-dist and GitHub Actions, with proper documentation for the NPM_TOKEN secret setup.

Major changes:

• npm publishing workflow that downloads artifacts and publishes to npm registry using cargo-dist integration
• Copilot CLI harness support with MCP configuration, installation instructions, and alias canonicalization (copilot → copilot-cli)
• New TUI empty state widget with platform-specific installation instructions for all harnesses
• Updated documentation across README and CONTRIBUTING.md

Note: The PR title mentions only npm publishing, but includes significant Copilot CLI feature work across 15 commits. The git dependencies in Cargo.toml pointing to master branch will block crates.io publishing and affect user installations.

Confidence Score: 3/5

• Safe to merge after resolving git dependency issue
• The npm publishing workflow is well-implemented with proper secret handling and conditional logic. Copilot CLI integration follows existing patterns consistently. However, the git dependencies on master branch in Cargo.toml will prevent crates.io publishing and cause installation issues for users - this must be resolved before the next release.
• Pay close attention to Cargo.toml - git dependencies must be replaced with versioned crates before releasing

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Added publish-npm job that downloads artifacts and publishes to npm registry using NPM_TOKEN, updated announce job dependencies
dist-workspace.toml	Added npm to installers array and publish-jobs, configured npm-package = "bridle-ai"
CONTRIBUTING.md	Added Publishing & Releases section documenting NPM_TOKEN setup with granular token instructions
src/harness/install_instructions.rs	New file providing platform-specific installation instructions for all harnesses including Copilot CLI, and empty state messages
Cargo.toml	Changed harness-locate and skills-locate from crates.io versions to git dependencies on master branch, added textwrap dependency

Sequence Diagram

sequenceDiagram
    participant Trigger as GitHub Release
    participant Plan as plan job
    participant Host as host job
    participant NPM as publish-npm job
    participant Homebrew as publish-homebrew-formula job
    participant Announce as announce job
    
    Trigger->>Plan: Trigger on release tag
    Plan->>Plan: Parse release plan with cargo-dist
    Plan->>Host: Pass plan output
    Host->>Host: Build artifacts for all platforms
    Host->>Host: Upload artifacts-* (includes -npm-package.tar.gz)
    
    par Parallel Publishing
        Host->>NPM: Artifacts ready
        NPM->>NPM: Download artifacts-* to npm/
        NPM->>NPM: Setup Node.js 20.x
        NPM->>NPM: Filter releases with -npm-package.tar.gz
        NPM->>NPM: Run npm publish --access public
        Note over NPM: Uses NODE_AUTH_TOKEN (NPM_TOKEN secret)
    and
        Host->>Homebrew: Artifacts ready
        Homebrew->>Homebrew: Publish Homebrew formula
    end
    
    NPM->>Announce: Success/Skip
    Homebrew->>Announce: Success/Skip
    Announce->>Announce: Create release announcement
    Note over Announce: Only if host succeeded and<br/>publish jobs succeeded or skipped

Loading

[greptile-apps]

_{23 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

logic: Git dependencies pointing to master branch will cause issues for users installing via cargo and for publishing to crates.io. Consider:

• Publishing new versions of harness-locate and skills-locate to crates.io with Copilot CLI support
• Reverting to versioned crate dependencies before releasing

Suggested change

	harness-locate = { git = "https://github.com/neiii/harness-barn", branch = "master" }
	skills-locate = { git = "https://github.com/neiii/harness-barn", branch = "master" }
	harness-locate = "0.4.0" # or appropriate version with CopilotCli support
	skills-locate = "0.3.0" # or appropriate version

Prompt To Fix With AI

This is a comment left during a code review.
Path: Cargo.toml
Line: 15:16

Comment:
**logic:** Git dependencies pointing to `master` branch will cause issues for users installing via cargo and for publishing to crates.io. Consider:
- Publishing new versions of `harness-locate` and `skills-locate` to crates.io with Copilot CLI support
- Reverting to versioned crate dependencies before releasing

```suggestion
harness-locate = "0.4.0"  # or appropriate version with CopilotCli support
skills-locate = "0.3.0"   # or appropriate version
```

How can I resolve this? If you propose a fix, please make it concise.