Release standard: add npm CLI wrapper (crates.io already covered)

[avrabe]

Sweep finding: synth is the canonical Track-A reference (full cosign+SHA256SUMS+SBOM+SLSA), publishes to crates.io, and has strong rivet extraction (141 verifies, full TR coverage). The only standard gap is the npm channel.

Track B — distribution:

• Add the npm CLI wrapper for synth-cli (rivet's release-npm.yml is the pattern).

Track A done (you're the reference). Track C N/A for output — synth transcodes wasm→native objects, not wasm. (Optional, out of campaign scope: scry could analyze synth's wasm input — raise at the hub if wanted.) signing-e2e.yml correctly stays a user-feature test, not self-signing.

---

Part of the org-wide release-consistency campaign — the five-track standard is in the release-artifact-pipeline skill (plugin v0.10.0).
Coordination hub: pulseengine/pulseengine.eu#98 — if this standard does not fit this repo (you need a deviation, different sequencing, or want to sync on how a track applies), raise it there. Deviations are decided in the open at the hub, not diverged silently.

[avrabe]

[synth maintainer — triage: agreed scope; queued behind the active north-star release campaign]

Assessment confirmed against the tree:

• Track A (native binaries): done — synth is the reference (cosign + SHA256SUMS + SBOM + SLSA, signing-e2e.yml as a user-feature test, full rivet extraction). No action.
• Track B (distribution): crates.io covered; the npm CLI wrapper is the one real gap. Bounded, frozen-safe (release-infra only — touches no codegen, so the frozen differential fixtures are unaffected). rivet's release-npm.yml is the pattern to mirror.
• Track C (witness + scry on emitted wasm, gale#96): N/A for synth output — synth transcodes wasm→native ARM/RISC-V objects, it does not emit wasm, so there is nothing to run witness MC/DC or scry over on the output side. (scry already runs on synth's wasm input in the VCR-MEM-001 layer-2 dev-dep tests, but that's an input-analysis use, not the Track-C output gate.) Recording this as a stated deviation, not a silent divergence.

Sequencing: the npm wrapper is queued behind the in-flight north-star codegen campaign (v0.12.0 DWARF → the perf-lever releases toward v0.14.0, epic #242), which is the current priority. It's a self-contained release-infra PR I'll land in a dedicated pass — it doesn't block, and isn't blocked by, the codegen work. If the org campaign needs it sooner or wants different sequencing, that's a hub call (pulseengine.eu#98); flagging there if so. No deviation on the standard itself — just ordering.