Add npm release workflows for CUA packages

[rgarcia]

Summary

• add tag-triggered npm publish workflows for @onkernel/cua-ai and @onkernel/cua-agent
• validate release tags against package versions and require tagged commits to be on main
• add npm publish metadata and release instructions for trusted publishing setup
• add a repo skill for preparing package releases, choosing versions, writing changelogs, tagging, and monitoring workflows

Testing

• npm ci
• npm run build --workspace @onkernel/cua-ai
• npm test --workspace @onkernel/cua-ai -- test/api-keys.test.ts test/models.test.ts test/providers.test.ts test/runtime-spec.test.ts test/tools.test.ts test/yutori-payload.test.ts
• npm run build --workspace @onkernel/cua-agent
• npm test --workspace @onkernel/cua-agent -- test/agent.test.ts test/tool-exhaustiveness.test.ts
• npm pack --workspace @onkernel/cua-ai --dry-run
• npm pack --workspace @onkernel/cua-agent --dry-run
• git diff --check

Release note

The package names are not currently published on npm. npm requires a package to exist before configuring trusted publishing, so the initial package bootstrap still needs to be handled before tag-based trusted publishing can run.

---

Note

Medium Risk
Adds automated npm publishing via GitHub Actions tags, which can unintentionally publish bad versions if tagging/version checks are wrong. Mitigated by enforcing tag-on-main, matching tag/package versions, running build/tests, and packing before publish.

Overview
Introduces tag-triggered GitHub Actions workflows to publish @onkernel/cua-ai and @onkernel/cua-agent to npm from cua-ai/v* and cua-agent/v* tags, including checks that the tag points to a commit on main, matches package.json version, and that builds/tests/npm pack --dry-run pass.

For @onkernel/cua-agent, the workflow additionally verifies the pinned @onkernel/cua-ai dependency version is already published before releasing.

Updates package publish metadata (adds license, repository/bugs/homepage, and publishConfig.access=public) and adds operational docs (docs/npm-releases.md and .agents/skills/release/SKILL.md) describing trusted publishing setup, versioning, tagging, and release steps.

^{Reviewed by Cursor Bugbot for commit 30e39e0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: PR modifies npm release workflows for CUA packages, not kernel API endpoints or Temporal workflows as specified in the filter.

To monitor this PR anyway, reply with @firetiger monitor this.