feat: add versioned CLI releases and npm installation archives

[hetaoBackend]

Change

pnpm release:cli --version X.Y.Z now creates a release branch from the latest reviewed origin/main, updates the root and TUI package versions, commits them, creates an annotated version tag, atomically pushes the branch/tag, and opens a version PR back to main. A dry run checks the plan without changing source or pushing. The command rejects dirty/stale checkouts, version regressions and existing release refs; it never pushes main or force-updates a tag.

The tag-triggered workflow requires both committed source versions to match the tag. It runs source verification, builds an npm-installable minimax-code-X.Y.Z.tar.gz, and validates that same archive across Linux/macOS and Node 22.19.0, 24.2.0, 25 and 26 before publishing a GitHub Release with the archive and SHA-256 checksum. Prerelease tags produce prereleases; assets upload to a draft before publication. Manual dispatch and release-tool PR checks do not publish.

Packages include compiled runtime assets, license texts, source revision receipts and pinned direct external dependencies. Users provide Node.js and install the tar.gz with npm. This does not publish to npm or change the official installer. Documentation covers the version PR, installation, shared npm package identity/user data, updater behavior and failure recovery.

Validation

• PASS on remote head a8316d725ad231aa0a2619ada87c2a08f4f4a00c: all 8 Linux/macOS installation combinations (Node 22.19.0, 24.2.0, 25, 26), both source-verification jobs, release audit, build and CodeQL. PR checks: 19 passed, 0 failed, 3 expected skips; publication remains skipped for pull requests. CLI release run.
• CI compatibility fix (a8316d7): run the BYOK proxy scenarios sequentially without awaiting t.test(), whose return value is undefined on Node 24.0–24.2 (Node 24 test runner module does not wait for subtests to finish nodejs/node#58227). All 10 proxy scenarios and their assertions remain covered. Using the original CI archive on Node 24.2.0 reproduced the request-count failure before the change and passed after it; local pnpm test:byok also passed on Node 26.4.0.
• PASS on 48ada67014a7b78b7ae30eb45fe594770f6e53b8 (macOS arm64, Node 26.4.0): VITEST_MAX_WORKERS=2 MCODE_RELEASE_TAG=v0.4.12 pnpm verify — all 14 full-profile gates passed.
• PASS: packaged the clean committed build and ran pnpm verify --profile package against the resulting tar.gz in a fresh npm prefix. The installed launcher reported 0.4.12; native SQLite/ripgrep checks and all 32 smoke/BYOK tests passed. SHA-256: d528058b330cc53392468a8438647a2f3439937546090736f6a6d979e09a5e70.
• An earlier default-concurrency full run timed out in five existing runtime test files. Their focused replay passed (331 tests), and the final complete run passed with two Vitest workers; no test deadlines were increased.
• Isolated Git release-command tests (including rejected atomic pushes), tag/source-version validation, dependency manifest, exact-archive installation receipts and workflow publication-boundary regressions are covered in the existing release-tools suite.
• NOT RUN: actual tag-triggered publication, npm registry publication, Windows or live-service acceptance. GitHub installation-matrix results are tracked on this PR.

Publication and contribution checks

• I have permission to contribute these changes under the existing licenses applicable to the changed files/packages; imported material and its provenance are identified and existing notices are preserved.
• No credentials, account data, real user content, internal source history or private review material is included.
• Added/removed source files were reviewed before regenerating release/public-source.json; new tests are declared in test/vitest-suites.json where applicable.
• Shared English/Chinese documentation and capability/verification records are updated where applicable. Mock/offline results are not described as live-service acceptance.

Maintainer handoff

Publication scope: enables tag-triggered GitHub installation-package releases after merge. No tag, release, npm publication or official installer update is performed by this PR. Source manifests remain private; the release command updates both source versions before tagging, and its version PR carries that change back to main.

Shared-source port: not needed; this is public distribution/release tooling and its local test harness.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}