feat(cli): prepare npm release

[caio-pizzol]

What changed

• Fix the MCP deployment so Wrangler uses Bun from its subdirectory.
• Publish @ooxml-dev/cli@0.1.0 to npm and configure the release workflow to authenticate future npm releases.
• Replace the root Bun devEngines declaration with packageManager so npm can pack and publish the CLI while Vite+ still selects Bun.
• Update the README with the npm install command, the research-ooxml skill, and a short production-service sign-in note.
• Keep MCP protocol details in the MCP section and remove auth implementation details from the main README.

Why

The CLI had a 0.1.0 tag but had never been published. npm also could not run because the root devEngines declaration required Bun. These changes publish the CLI and keep future releases automated through Changesets.

Verified

• bun run check
• bun run cli:test
• bun run --cwd apps/cli build
• npm publish --dry-run --access public
• Published @ooxml-dev/cli@0.1.0 through release run 31688309173
• Installed @ooxml-dev/cli@0.1.0 from npm and ran ooxml --version and ooxml --help
• bun run wrangler deploy --dry-run from apps/mcp-server
• npx skills add superdoc/ooxml-dev --skill research-ooxml -g -y

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

---

View medium (1)

🟠 **Medium**

1. Release requires npm token 🐞

Description

The release workflow now depends on secrets.NPM_TOKEN being configured with publish permissions;
if it’s missing/invalid, the Changesets publish step will fail with an npm authentication error and
block releases.

Code

.github/workflows/release.yml[R45-46]

+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

Relevance

●●● Strong

Team often accepts hardening workflows/env config to fail safely when required secrets/vars are
missing.

PR-#15
PR-#17

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The workflow passes NODE_AUTH_TOKEN from secrets.NPM_TOKEN into the Changesets step, and the
invoked publish script is changeset publish, which requires npm authentication to publish
packages.

.github/workflows/release.yml[31-46]
package.json[20-24]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The workflow now publishes via `changeset publish` and relies on `NODE_AUTH_TOKEN` from `secrets.NPM_TOKEN`. If the secret is unset/invalid or lacks publish permission, the workflow will fail late during publish with an npm 401, blocking releases.

### Issue Context
`release:publish` runs `changeset publish`, which requires npm registry authentication.

### Fix Focus Areas
- .github/workflows/release.yml[31-46]
- package.json[20-24]

### Suggested fix
1) Add an explicit preflight step before `changesets/action` to validate that `secrets.NPM_TOKEN` is present (non-empty), and optionally that it can authenticate (e.g., `npm whoami`), failing with a clear message.
2) Ensure repo/org secrets documentation (or the workflow itself via `error::`) indicates the required secret name and required npm permissions (automation token that can publish `@ooxml-dev/*`).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

---

Context

✅ Compliance rules (platform): 11 rules

Review mode: ⚖️ Balanced: This small workflow-only change alters npm release authentication and token propagation, a security- and release-sensitive path warranting a complete review.

---

Tip of the day

💡 Did you know, you can type 'qodo, fix this' on a finding and the fix lands right on your PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

---

Previous review results

Review updated until commit a9a4c14 ⚖️ Balanced

Results up to commit bdf4a03 ⚖️ Balanced

No changes from previous review

Results up to commit ddf2366 ⚖️ Balanced

No changes from previous review

Powered by Qodo

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}

[cubic-dev-ai]

All reported issues were addressed across 5 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[caio-pizzol]

Verified in the real release path: NPM_TOKEN is configured with publish access, and release run 31688309173 published @ooxml-dev/cli@0.1.0. A separate npm whoami step would not prove package-level publish access and could block version-PR creation when no npm publish is needed, so the existing npm error is the clearer failure path.