feat: publish release contents to an npm registry

The generic archive and its installer are opaque to coding agents: something
external has to download and unpack them, which is why the generated installer
script exists. Agents can resolve npm packages on their own, so publishing the
same release contents to an npm registry lets them install and update without
an installer in the loop.

Opt in with `publish_npm`. The package is built from the same staged directory
as the generic archive, so the two cannot drift, and `package.json` is generated
with the release version so it stays in step with the plugin manifest versions
that release-please already bumps.

Two npm behaviours are handled explicitly:

- `npm pack <path>` without a leading `./` is parsed as a GitHub owner/repo
  spec, so npm attempts a clone instead of packing the directory.
- npm's ignore rules can drop dot-directories, and the agent catalogs live in
  `.agents/` and `.claude-plugin/`. The packed tarball is verified to contain
  every released path before publishing, rather than shipping a package that
  installs but has no catalog.

The generic archive, installer, and GitHub Release paths are unchanged, so
existing consumers are unaffected.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Jm9AfbCJBD4tkxnxxnq7Wm

README.md

@@ -8,6 +8,7 @@ This repository intentionally contains only generic marketplace automation:
 - skill and plugin manifest validation
 - pull-request preview archives
 - release archives and installation summaries
+- optional npm registry publishing for agents that support npm catalogs
 
 Container, infrastructure, deployment, and environment-specific workflows are
 kept in the private `Walter0697/common-workflow` repository.
@@ -28,3 +29,34 @@ The validator is also available as:
 ```yaml
 uses: walter-base/common-workflow/actions/validate-agent-marketplace@master
 ```
+
+## Publishing to an npm registry
+
+The generic archive and its installer are opaque to coding agents: something has
+to download and unpack them, which is what the generated installer script does.
+Agents can, however, resolve npm packages on their own, so publishing the same
+release contents to an npm registry lets them install and update without an
+installer.
+
+Enable it on the release workflow:
+
+```yaml
+with:
+  publish_npm: true
+  npm_package_name: "@acme/agent-skills"
+  # npm_registry defaults to the Gitea npm registry for gitea_user
+secrets:
+  GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+```
+
+Notes:
+
+- the package is built from the same staged directory as the generic archive, so
+  the two can never drift apart
+- `package.json` is generated at publish time with the release version, which
+  keeps it in step with the plugin manifest versions that release-please bumps
+- `npm_package_name` must be scoped, and the scope must match the registry owner
+- `NPM_TOKEN` is used when set; otherwise `GITEA_TOKEN` is reused
+- publishing fails if any released path is absent from the packed tarball, which
+  guards against npm's ignore rules silently dropping `.agents/` or
+  `.claude-plugin/`