feat: NPM wrapper + Trusted Publishing + Docker GHCR

[lyonzin]

Summary

• NPM wrapper (npm/) — enables npx knowledge-rag for zero-config installation
• Fixed release pipeline — migrated from broken API token to Trusted Publishing (OIDC)
• Added NPM auto-publish — version syncs from git tag automatically
• Added Docker GHCR push — ghcr.io/lyonzin/knowledge-rag:latest

NPM Wrapper Details

The wrapper is a thin Node.js CLI that:

1. Auto-detects Python 3.11+ (cross-platform: Windows python/py -3, Unix python3/python)
2. Creates persistent venv at ~/.knowledge-rag/venv
3. Installs exact PyPI version (pinned to NPM package version)
4. Runs MCP server with stdio inherited
5. All wrapper output to stderr (MCP protocol compatibility)
6. Signal forwarding (SIGINT/SIGTERM) for clean shutdown
7. Smart reinstall — only when NPM version changes

Zero external dependencies. Pure Node.js stdlib.

Release Pipeline Changes

Before	After
PYPI_API_TOKEN secret (broken)	Trusted Publishing OIDC (no secrets)
Single test matrix	Multi-Python (3.11, 3.12)
No artifact separation	Build once, publish once
Docker build only	Docker push to GHCR
PyPI only	PyPI + NPM + Docker

Manual Steps Required (before merging)

1. PyPI Trusted Publisher — configure on pypi.org/manage/project/knowledge-rag/settings/publishing/
2. GitHub Environment — create release environment in repo settings
3. NPM Token — add NPM_TOKEN secret to release environment

See PR comments for detailed instructions.

Files Changed

• .github/workflows/release.yml — complete rewrite
• npm/package.json — NPM package metadata
• npm/bin/cli.js — CLI wrapper (266 lines, zero deps)
• npm/README.md — NPM-specific docs
• npm/.npmignore — whitelist-only publish filter