chore(release): npm publish pipeline + a global-install check that boots a show

[pyramation]

Summary

Distribution is npm + GitHub, not a packaged installer: an operator runs npm i -g @wavegrid/cli and gets the brain, the receiver, and the built artist UI. This makes that claim testable instead of assumed, and adds the workflow that publishes it.

deploy/verify-global-install.js (pnpm verify:install, now a CI step) reproduces a real install:

pnpm pack each public package        # honours publishConfig.directory, rewrites workspace:* → exact versions
npm install with overrides = { "@wavegrid/*": "file:…tgz" }   # nested deps resolve to the tarballs, not the registry
wavegrid projects create + start     # APPSTASH_BASE_DIR → a throwaway store, never ~/.wavegrid
assert GET / → 200, its /assets/*.js → 200 (>1kB), doctor --json has server + ≥1 receiver + no failing check

The workspace hides two bug classes that only bite an operator, both now covered:

1. A published package depending on an unpublished one. Checked statically before packing — inside the monorepo @wavegrid/discovery resolves to a sibling directory whether or not it's on the registry, so pnpm install is green while npm i -g 404s. (Currently latent: cli@1.4.0 on npm predates its discovery and doctor deps, so the next publish must include both — which is exactly what the check enforces.) Verified by temporarily marking discovery private: the script fails naming both dependents.
2. A file missing from the tarball — specifically @wavegrid/ui's built Vite bundle, which the brain serves from require.resolve('@wavegrid/ui/package.json')/../dist. Asserting the asset referenced by the served index.html returns >1kB catches a UI that shipped without dist/.

.github/workflows/release.yml: a v* tag rebuilds, re-runs the verification, pnpm -r publish --access publices every public package (private desktop/webgl skipped), and cuts a GitHub release. Versioning stays local (pnpm release:version → lerna, independent, conventional commits) — the workflow only publishes what the tagged commit holds, so re-running it is safe.

Needs an NPM_TOKEN repo secret with publish rights to the @wavegrid scope; nothing else. No signing, no Electron packaging.

Link to Devin session: https://app.devin.ai/sessions/972698f89f494b86828010666a002b8f
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Closing — premature complexity. Cloning the repo is fine for the current single-operator workflow; revisit the npm publish pipeline when the app is handed to someone else.