ci: add release-please workflow with npm publish on release

- release-please creates/updates release PR on pushes to main
- npm publish triggers automatically when release PR merges
- publishes with --provenance for supply chain security

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: gracefullight

.github/workflows/release.yml

@@ -0,0 +1,51 @@
+# Release Workflow — release-please PR → npm publish on merge
+#
+# 1. release-please creates/updates a release PR on every push to main
+# 2. When the release PR merges, it creates a GitHub Release
+# 3. The npm publish job triggers on the new release
+
+name: Release
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    name: Release Please
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs['apps/cli--release_created'] }}
+      tag_name: ${{ steps.release.outputs['apps/cli--tag_name'] }}
+    steps:
+      - uses: googleapis/release-please-action@v4
+        id: release
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+  npm-publish:
+    name: Publish to npm
+    runs-on: ubuntu-latest
+    needs: release-please
+    if: needs.release-please.outputs.release_created == 'true'
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - run: bun install --frozen-lockfile
+      - run: bun run build
+        working-directory: apps/cli
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+      - run: npm publish --provenance --access public
+        working-directory: apps/cli
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  "apps/cli": "0.1.0"
+}

release-please-config.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "packages": {
+    "apps/cli": {
+      "package-name": "agent-valley",
+      "release-type": "node",
+      "changelog-path": "CHANGELOG.md",
+      "bump-minor-pre-major": true,
+      "bump-patch-for-minor-pre-major": true
+    }
+  }
+}