ci(smcp): add tag-driven npm release pipeline

[akhilesharora]

Summary

Adds a tag-driven npm release pipeline for @datacline/smcp with provenance and automatic GitHub release creation, plus a CI workflow, build/lint scaffolding, and supporting repo governance files.

Changes

• .github/workflows/release.yml — fires on v* tag pushes. Runs lint/build/test, verifies the tag matches packages/smcp/package.json version, verifies tarball contents (required + forbidden file checks), derives the npm dist-tag from the version (alpha/beta/rc/next/latest), publishes with --access public --provenance, and creates a GitHub release with generated notes.
• .github/workflows/ci.yml — runs on push:main and pull_request. test job uses a Node 18.17/20/22 matrix (lint+build+test); pack-check job verifies tarball contents on Node 20.
• .github/workflows/cli-publish.yml — removed (superseded by release.yml).
• packages/smcp/:
  • tsup.config.ts — bundles bin/smcp.js → dist/smcp.{cjs,mjs} for Node 18+; shebang preserved from source.
  • tsconfig.json — allowJs, noEmit, used by tsc --noEmit lint.
  • CHANGELOG.md, LICENSE — included in the published tarball.
  • package.json — bin/main/module now point at dist/; adds build (tsup) and lint (tsc --noEmit) scripts; devDeps tsup, typescript, @types/node; files: [dist, README.md, CHANGELOG.md, LICENSE].
• .github/dependabot.yml — weekly updates for npm (grouped dev deps) and github-actions.
• .github/PULL_REQUEST_TEMPLATE.md — PR template.
• .github/ISSUE_TEMPLATE/{bug_report,feature_request}.md — issue templates for the CLI.
• package-lock.json — committed so CI npm ci works deterministically.

Test plan

• npm run lint --workspace @datacline/smcp clean (tsc --noEmit)
• npm run build --workspace @datacline/smcp clean (ESM + CJS in dist/, both with #!/usr/bin/env node preserved)
• npm test --workspace @datacline/smcp passes
• node packages/smcp/dist/smcp.cjs --help and node packages/smcp/dist/smcp.mjs --help both succeed
• npm pack --dry-run --workspace @datacline/smcp ships exactly: CHANGELOG.md, LICENSE, README.md, dist/smcp.{cjs,mjs}{,.map}, package.json. No bin/, src/, test/, tsconfig.json, or tsup.config.ts leak into the tarball.
• All workflow YAML parses cleanly; dist-tag logic verified across version shapes (0.1.0→latest, *-alpha.*→alpha, *-beta.*→beta, *-rc.*→rc, *-next.*→next)
• npm access list packages @datacline confirms publish rights on the scope

Breaking changes?

For end users of @datacline/smcp: the runtime bin location moves from bin/smcp.js to dist/smcp.cjs. Anyone invoking smcp ... after npm i -g @datacline/smcp is unaffected (npm resolves via the bin field). No public API surface to break.

Gateway / policy-engine changes?

None.

After merge

1. Ensure NPM_TOKEN is set on this repo (Settings → Secrets and variables → Actions → New repository secret).
2. git tag v0.1.0 && git push origin v0.1.0 to publish the first version.