feat: publish dev builds as GitHub pre-releases instead of npm

Split the publish workflow so dev builds (push to main) create GitHub
pre-releases with tarballs instead of publishing to npm. This stops
polluting the npm registry with transient dev versions.

- Add publish-dev job: npm pack + gh release create --prerelease
- Auto-prune old dev releases, keeping only the last 5
- Simplify dev version computation (no more npm registry query)
- Stable publish job unchanged (still publishes to npm with OIDC)

Author: github-actions[bot]

.github/workflows/publish.yml

@@ -66,25 +66,9 @@ jobs:
             echo "Stable release (manual retry): $VERSION"
           else
             IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT"
-            BASE_PATCH=$((PATCH + 1))
+            DEV_PATCH=$((PATCH + 1))
             SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
-
-            # Query npm for the highest dev patch number published so far
-            LATEST_DEV=$(npm view "@optave/codegraph" versions --json 2>/dev/null \
-              | node -e "
-                const versions = JSON.parse(require('fs').readFileSync(0,'utf8'));
-                const prefix = '${MAJOR}.${MINOR}.';
-                let maxPatch = ${BASE_PATCH} - 1;
-                for (const v of (Array.isArray(versions) ? versions : [versions])) {
-                  if (v.startsWith(prefix) && v.includes('-dev.')) {
-                    const patch = parseInt(v.split('.')[2], 10);
-                    if (patch > maxPatch) maxPatch = patch;
-                  }
-                }
-                console.log(maxPatch + 1);
-              " 2>/dev/null) || LATEST_DEV="$BASE_PATCH"
-
-            VERSION="${MAJOR}.${MINOR}.${LATEST_DEV}-dev.${SHORT_SHA}"
+            VERSION="${MAJOR}.${MINOR}.${DEV_PATCH}-dev.${SHORT_SHA}"
             NPM_TAG="dev"
             echo "Dev release: $VERSION"
           fi
@@ -152,7 +136,141 @@ jobs:
           path: crates/codegraph-core/*.node
           if-no-files-found: error
 
+  # ── Dev builds: GitHub pre-release with tarballs ──
+
+  publish-dev:
+    if: github.event_name == 'push'
+    needs: [compute-version, build-native]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - run: npm install
+
+      - name: Set version
+        env:
+          VERSION: ${{ needs.compute-version.outputs.version }}
+        run: |
+          npm version "$VERSION" --no-git-tag-version --allow-same-version
+          node scripts/sync-native-versions.js
+          echo "Packaging version $VERSION"
+
+      - name: Disable prepublishOnly
+        run: npm pkg delete scripts.prepublishOnly
+
+      - name: Download native artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: ${{ runner.temp }}/artifacts/
+
+      - name: Pack main package
+        run: npm pack
+
+      - name: Pack platform packages
+        env:
+          VERSION: ${{ needs.compute-version.outputs.version }}
+        shell: bash
+        run: |
+          declare -A PACKAGES=(
+            ["linux-x64"]="@optave/codegraph-linux-x64-gnu"
+            ["darwin-arm64"]="@optave/codegraph-darwin-arm64"
+            ["darwin-x64"]="@optave/codegraph-darwin-x64"
+            ["win32-x64"]="@optave/codegraph-win32-x64-msvc"
+          )
+
+          ARTIFACTS="${RUNNER_TEMP}/artifacts"
+          PKG_DIR="${RUNNER_TEMP}/pkg"
+
+          for artifact_dir in "${ARTIFACTS}"/native-*/; do
+            platform=$(basename "$artifact_dir" | sed 's/^native-//')
+            pkg_name=${PACKAGES[$platform]}
+            node_os=${platform%%-*}
+            node_arch=${platform##*-}
+
+            mkdir -p "${PKG_DIR}/$platform"
+            cp "$artifact_dir"/*.node "${PKG_DIR}/$platform/codegraph-core.node"
+
+            cat > "${PKG_DIR}/$platform/package.json" <<PKGJSON
+          {
+            "name": "${pkg_name}",
+            "version": "${VERSION}",
+            "description": "Native codegraph-core binary for ${node_os}-${node_arch}",
+            "os": ["${node_os}"],
+            "cpu": ["${node_arch}"],
+            "main": "codegraph-core.node",
+            "files": ["codegraph-core.node"],
+            "license": "Apache-2.0",
+            "repository": {
+              "type": "git",
+              "url": "https://github.com/optave/codegraph.git"
+            }
+          }
+          PKGJSON
+
+            npm pack "${PKG_DIR}/$platform"
+          done
+
+      - name: Create GitHub pre-release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ needs.compute-version.outputs.version }}
+        run: |
+          TAG="dev-v${VERSION}"
+          gh release create "$TAG" \
+            --prerelease \
+            --title "Dev build ${VERSION}" \
+            --notes "Dev build from commit \`${{ github.sha }}\` on \`main\`." \
+            *.tgz
+
+      - name: Prune old dev releases
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # List dev releases sorted newest-first, skip the first 5, delete the rest
+          gh release list --limit 100 --json tagName,isPrerelease,createdAt \
+            | jq -r '
+                [ .[] | select(.isPrerelease and (.tagName | startswith("dev-v"))) ]
+                | sort_by(.createdAt) | reverse
+                | .[5:]
+                | .[].tagName
+              ' \
+            | while read -r tag; do
+                echo "Deleting old dev release: $tag"
+                gh release delete "$tag" --yes --cleanup-tag
+              done
+
+      - name: Summary
+        env:
+          VERSION: ${{ needs.compute-version.outputs.version }}
+        run: |
+          TAG="dev-v${VERSION}"
+          cat >> "$GITHUB_STEP_SUMMARY" <<EOF
+          ## Dev Build Published
+
+          **Version:** \`${VERSION}\`
+          **Commit:** \`${{ github.sha }}\`
+
+          ### Download
+
+          Tarballs attached to [GitHub release \`${TAG}\`](${{ github.server_url }}/${{ github.repository }}/releases/tag/${TAG}).
+
+          \`\`\`bash
+          # Install the main package from the release tarball:
+          npm install ${{ github.server_url }}/${{ github.repository }}/releases/download/${TAG}/optave-codegraph-${VERSION}.tgz
+          \`\`\`
+          EOF
+
+  # ── Stable releases: publish to npm ──
+
   publish:
+    if: github.event_name != 'push'
     needs: [compute-version, build-native]
     runs-on: ubuntu-latest
     environment: npm-publish
@@ -179,7 +297,6 @@ jobs:
       - run: npm install
 
       - name: Set version
-        id: version
         env:
           VERSION: ${{ needs.compute-version.outputs.version }}
         run: |
@@ -270,20 +387,15 @@ jobs:
           NPM_TAG: ${{ needs.compute-version.outputs.npm_tag }}
         run: npm publish --access public --provenance --tag "$NPM_TAG"
 
-      # ── Stable-only: version bump PR and tag ──
-
       - name: Configure git
-        if: github.event_name != 'push'
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
       - name: Generate DEPENDENCIES.json
-        if: github.event_name != 'push'
         run: mkdir -p generated && npm ls --json --all --omit=dev > generated/DEPENDENCIES.json 2>/dev/null || true
 
       - name: Push version bump via PR
-        if: github.event_name != 'push'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERSION: ${{ needs.compute-version.outputs.version }}
@@ -313,25 +425,3 @@ jobs:
             git tag -a "$TAG" -m "release: $TAG"
             git push origin "$TAG"
           fi
-
-      # ── Dev-only: summary with install instructions ──
-
-      - name: Summary
-        if: github.event_name == 'push'
-        env:
-          VERSION: ${{ needs.compute-version.outputs.version }}
-        run: |
-          cat >> "$GITHUB_STEP_SUMMARY" <<EOF
-          ## Dev Release Published
-
-          **Version:** \`${VERSION}\`
-          **Commit:** \`${{ github.sha }}\`
-
-          ### Install
-
-          \`\`\`bash
-          npm install @optave/codegraph@dev
-          # or pin this exact version:
-          npm install @optave/codegraph@${VERSION}
-          \`\`\`
-          EOF