Add release pipeline and upgrade toolchain to TypeScript 7

Publishing infrastructure
- Three Gitea workflows: ci.yml (PRs, non-main pushes), publish-snapshot.yml
  (main -> Gitea under dist-tag @main) and release.yml (tags -> Gitea + npmjs)
- Tag-driven releases as <package-dir>-v<version>; the manifest stays the
  source of truth and release.yml refuses to run if tag and manifest disagree
- Every publish is idempotent: each step checks the registry first, so a run
  that fails on the second registry can simply be re-run
- Hard coverage gate (85% branches) shared by CI, the pre-push hook and local
  runs, since the thresholds live in vitest.config.ts rather than a CI flag
- README.PUBLISH.md documents the whole mechanism

Toolchain
- TypeScript 7 native compiler; drop tsgo and ts-node, use tsx for dev runs
- Biome 1.9 -> 2.x, Vitest 1 -> 4, zod 3 -> 4, inquirer 8 -> 14, pnpm 11.17.0
- Replace inquirer-checkbox-plus-prompt, which is peer-capped at inquirer <9,
  with enquirer's AutoComplete; the CubeSelection contract is unchanged
- Stand in for zod 4's removed z.AnyZodObject with a local AnyObjectSchema

Repo hygiene
- Stop tracking dist/; ignore coverage/, *.tsbuildinfo, .npmrc* and release.json
- Drop package-lock.json in favour of pnpm-lock.yaml

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/nopy/package.json

@@ -1,44 +1,73 @@
 {
   "name": "@bitstack/nopy",
-  "description": "A system to simplify pyinfra script management and execution.",
-  "type": "module",
   "version": "1.0.0",
-  "private": true,
+  "description": "A system to simplify pyinfra script management and execution.",
+  "keywords": [
+    "pyinfra",
+    "deployment",
+    "cli",
+    "infrastructure"
+  ],
+  "license": "MIT",
   "author": "bitsquare",
-  "bin": "./dist/nopy.cli.js",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitea.bitsquare.dev/BitSquare/ansiblings.git",
+    "directory": "packages/nopy"
+  },
+  "homepage": "https://gitea.bitsquare.dev/BitSquare/ansiblings/src/branch/main/packages/nopy",
+  "bugs": {
+    "url": "https://gitea.bitsquare.dev/BitSquare/ansiblings/issues"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "bin": {
+    "nopy": "./dist/nopy.cli.js"
+  },
   "exports": {
-    ".": "./dist/index.js"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
   },
   "scripts": {
-    "clean": "rm -rf dist",
-    "build": "tsgo && chmod +x dist/nopy.cli.js && npm link",
-    "build:legacy": "tsc && chmod +x dist/nopy.cli.js && npm link",
-    "prepublishOnly": "npm run build",
-    "nopy": "node --loader ts-node/esm src/nopy.cli.ts",
-    "debug": "node --inspect-brk --loader ts-node/esm src/nopy.cli.ts",
+    "clean": "rm -rf dist .tsbuildinfo",
+    "build": "tsc",
+    "prepack": "pnpm run build",
+    "link:local": "pnpm run build && npm link",
+    "nopy": "tsx src/nopy.cli.ts",
+    "debug": "tsx --inspect-brk src/nopy.cli.ts",
     "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
     "test:integration": "vitest run --pool=forks",
     "test:watch": "vitest"
   },
-  "files": ["dist/"],
   "dependencies": {
-    "@logtape/logtape": "^0.8.0",
-    "commander": "^13.1.0",
+    "@logtape/logtape": "^2.2.4",
+    "commander": "^15.0.0",
     "enquirer": "^2.4.1",
-    "execa": "9.5.2",
+    "execa": "^10.0.0",
     "fuzzy": "^0.1.3",
-    "inquirer": "8.2.4",
-    "inquirer-checkbox-plus-prompt": "^1.0.1",
-    "ts-node": ">=10.9.1",
-    "typescript": ">=5.6.3",
-    "yaml": "^2.8.2",
-    "zod": "^3.24.1",
-    "zx": "^8.3.0"
+    "inquirer": "^14.0.2",
+    "zod": "^4.4.3",
+    "zx": "^8.8.5"
   },
   "devDependencies": {
-    "@types/inquirer": "^8.2.10",
-    "@types/node": "^20.0.0",
-    "@types/uniqid": "^5.3.4",
-    "vitest": "^1.6.0"
+    "@types/node": "^26.1.1",
+    "@vitest/coverage-v8": "^4.1.10",
+    "tsx": "^4.23.1",
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.10"
   }
 }