Add release pipeline and upgrade toolchain to TypeScript 7

Publishing infrastructure
- Three Gitea workflows: ci.yml (PRs, non-main pushes), publish-snapshot.yml
  (main -> Gitea under dist-tag @main) and release.yml (tags -> Gitea + npmjs)
- Tag-driven releases as <package-dir>-v<version>; the manifest stays the
  source of truth and release.yml refuses to run if tag and manifest disagree
- Every publish is idempotent: each step checks the registry first, so a run
  that fails on the second registry can simply be re-run
- Hard coverage gate (85% branches) shared by CI, the pre-push hook and local
  runs, since the thresholds live in vitest.config.ts rather than a CI flag
- README.PUBLISH.md documents the whole mechanism

Toolchain
- TypeScript 7 native compiler; drop tsgo and ts-node, use tsx for dev runs
- Biome 1.9 -> 2.x, Vitest 1 -> 4, zod 3 -> 4, inquirer 8 -> 14, pnpm 11.17.0
- Replace inquirer-checkbox-plus-prompt, which is peer-capped at inquirer <9,
  with enquirer's AutoComplete; the CubeSelection contract is unchanged
- Stand in for zod 4's removed z.AnyZodObject with a local AnyObjectSchema

Repo hygiene
- Stop tracking dist/; ignore coverage/, *.tsbuildinfo, .npmrc* and release.json
- Drop package-lock.json in favour of pnpm-lock.yaml

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/nopy/tests/hooks.test.ts

@@ -24,24 +24,28 @@ describe('Cube Hooks', () => {
 
     const cubes: Record<string, Cube> = {
       main: createMockCube('main', 'Main Cube', {
-        before: [async ({ exec }) => {
-          order.push('main:before');
-          await exec('before-hook', {});
-        }],
-        after: [async ({ exec }) => {
-          order.push('main:after');
-          await exec('after-hook', {});
-        }],
+        before: [
+          async ({ exec }) => {
+            order.push('main:before');
+            await exec('before-hook', {});
+          },
+        ],
+        after: [
+          async ({ exec }) => {
+            order.push('main:after');
+            await exec('after-hook', {});
+          },
+        ],
         dependencies: () => ['dep'],
       }),
       'before-hook': createMockCube('before-hook', 'Before Hook'),
       'after-hook': createMockCube('after-hook', 'After Hook'),
-      'dep': createMockCube('dep', 'Dependency'),
+      dep: createMockCube('dep', 'Dependency'),
     };
 
     // Note: buildDeployCall also records the main cube execution
     // We can't easily spy on buildDeployCall, but we can see the resulting deployCalls order
-    
+
     const vars = new Variables();
     const context = new BuildContext(
       cubes,
@@ -53,7 +57,7 @@ describe('Cube Hooks', () => {
 
     await context.resolveCube('main', 'host1');
 
-    const callOrder = context.deployCalls.map(c => c.cube);
+    const callOrder = context.deployCalls.map((c) => c.cube);
 
     // Expected order:
     // 1. main:before (hook runs)