[dDevAhmed]

Summary

Implements CLI-038 with a protected Changesets release pipeline for @stellarforge/cli.

Included

• makes the CLI package publication-ready with explicit public package metadata
• adds a minor Changeset for the first normal 0.1.0 release PR
• adds pinned Changesets select/version/pack/publish actions
• separates release PR creation from publication permissions
• validates and packs exact release artifacts before publication
• adds npm pack --dry-run readiness validation
• uses a protected npm-release environment for actual publication
• grants id-token: write only to the publish job
• pins a Trusted Publishing-compatible Node/npm runtime
• uses npm OIDC instead of a long-lived npm publishing token
• creates matching Git tags and GitHub Releases through Changesets
• gates real publication behind NPM_PUBLISH_ENABLED=true
• documents first-package bootstrap, environment configuration, rollback and hotfix flow
• adds tests that enforce critical release-workflow security properties
• accepts ADR-0003 as the implemented release architecture

First-publication safety

The workflow is safe to merge before npm Trusted Publishing is configured. Publication remains disabled until maintainers:

1. bootstrap @stellarforge/cli@0.0.0 once under a non-default bootstrap dist-tag using interactive maintainer authentication;
2. configure npm Trusted Publishing for DigiNodes/stellarforge-cli, workflow release.yml, environment npm-release;
3. protect the GitHub npm-release environment;
4. set repository variable NPM_PUBLISH_ENABLED=true.

No long-lived npm CI token is introduced.

Security

• top-level workflow permissions default to none
• release Actions are commit-SHA pinned
• checkout credentials are not persisted
• lifecycle scripts are disabled during dependency installation
• validation/packing is read-only
• OIDC is available only in the protected publish job
• untrusted pull-request code cannot trigger publishing
• publish artifacts are built/tested before the privileged job
• npm provenance remains enabled by Trusted Publishing

Closes #41