publish-releaselisted

# Publish a moi-computer release `publish-release` — preview under the `next` dist-tag. `publish-release stable` — real release under `latest`, with a GitHub release. **npm publishing happens only in GitHub Actions.** `.github/workflows/release.yml` authenticates via npm trusted publishing (OIDC), gated behind the `release` environment's required reviewer. There is no npm token anywhere and no npm session to reuse. - Never run `npm publish` yourself. It will fail, and it is not the path. - Never run `npm login` or ask the user for an OTP. - A tag push is what starts a release. Tags are awkward to retract — earn the push with §2 first. Two human checkpoints: the user confirms the version before the push, and approves the deployment in GitHub after it. Everything else runs unattended. ## 0. Preflight 1. `git status` — clean tree, on `main`. Stop and ask if not. 2. `git fetch && git status -sb` — up to date with `origin/main`. 3. `git log origin/main..HEAD --oneline` — if anything is unpushed, show it and confirm it should ship. 4. Record whether a dev `bun link` is active, because §8 branches on it: ```sh readlink ~/.bun/install/global/node_modules/moi-computer ``` A path into this repo means a dev link that §8 must restore. No output (it is a real directory) means an ordinary global install; a missing path means a clean container with nothing to put back. Do **not** check `~/.bun/bin/moi` for this. That symlink reads `../install/global/node_mod