Add workflow_dispatch prerelease publish for cua-cli

[rgarcia]

Summary

Adds .github/workflows/prerelease-cua-cli.yml — a manually-triggered workflow to publish a prerelease of @onkernel/cua-cli from any branch, so unmerged work can be exercised via a normal npm install.

• Trigger: workflow_dispatch with a dist_tag input (default ext).
• Version: publishes <pkg-version>-<dist_tag>.<run_number> (unique per run) under the chosen dist-tag, never latest — normal npm install @onkernel/cua-cli is unaffected.
• No on-main gate (that's the point) — unlike release-cua-cli.yml.
• Builds cua-ai/cua-agent/cua-cli, verifies the runtime deps are already published, packs, runs the bin smoke test, then npm publish --tag <dist_tag>.
• Lean: skips the ptywright native (Zig) build — it's a test-only devDependency, not needed to build/pack/publish the CLI.

Once published: npm install -g @onkernel/cua-cli@<dist_tag>.

Two one-time setup steps (required before first run)

1. Merge this to main. workflow_dispatch workflows are only dispatchable if they exist on the default branch. After merge, "Run workflow" appears under Actions and you can point it at any branch.
2. Authorize npm publishing. It publishes via OIDC trusted publishing (same mechanism as release-cua-cli.yml), so add this workflow as a trusted publisher for @onkernel/cua-cli on npmjs.com: repo kernel/cua, workflow prerelease-cua-cli.yml. (Alternatively, swap the publish step to a granular NPM_TOKEN secret — say the word and I'll wire that instead.)

Usage

Actions → Prerelease CUA CLI → Run workflow → pick the branch (e.g. hypeship/harness-extension-host) → set dist_tag → Run. Then npm i -g @onkernel/cua-cli@<dist_tag>.

Test plan

• Merge to main, add the trusted publisher
• Dispatch against hypeship/harness-extension-host with dist_tag=ext
• npm i -g @onkernel/cua-cli@ext and confirm cua --help shows --self-extend / --no-extensions

🤖 Generated with Claude Code

---

Note

Medium Risk
It can publish real npm packages from arbitrary branches under a non-latest tag; mistakes in dist-tag validation or trusted publishing setup could expose unintended builds, though default installs stay on latest.

Overview
Adds .github/workflows/prerelease-cua-cli.yml, a manually triggered pipeline to publish @onkernel/cua-cli from any branch (no on-main tag gate like release-cua-cli.yml).

On dispatch, you choose a dist_tag (default ext); the workflow rejects latest and invalid tag names, bumps the workspace version to <base>-<dist_tag>.<run_number>, runs npm ci, checks that pinned @onkernel/cua-ai / @onkernel/cua-agent versions exist on npm, builds those workspaces plus the CLI, npm pack, smoke-installs the tarball and asserts cua --help, then npm publish --tag <dist_tag> via OIDC (id-token: write). A job summary prints the install command npm install -g @onkernel/cua-cli@<dist_tag>.

Concurrency is per ref (prerelease-cua-cli-${{ github.ref_name }}); the workflow does not run the release workflow’s ptywright/Zig test-only build path.

^{Reviewed by Cursor Bugbot for commit c683c25. Bugbot is set up for automated code reviews on this repo. Configure here.}