build(npm): add @pulseengine/rivet distribution

[avrabe]

Summary

Adds the machinery to publish rivet as an npm package so it can be used
via npx @pulseengine/rivet and registered as a Claude Code MCP server
with claude mcp add rivet npx -y @pulseengine/rivet mcp.

• npm/ — root package @pulseengine/rivet. Uses per-platform
  optionalDependencies; index.js resolves the current platform's
  package, run.js spawns the binary (stdin/stdout/stderr + signals
  forwarded), install.js is a no-op when the platform package
  resolved and falls back to downloading the archive from the GitHub
  Release otherwise.
• platform-packages/{darwin-arm64,darwin-x64,linux-arm64,linux-x64,win32-x64}/
  — five per-platform packages. Each ships exactly one pre-built binary
  (gitignored in source, populated at publish time by the workflow).
• .github/workflows/release-npm.yml — triggers on release: published
  (so it runs after the existing release.yml creates the GitHub Release
  and uploads the archives). Downloads the archives via
  gh release download, assembles each platform package, publishes all
  platform packages in parallel, then publishes the root package last so
  optionalDependencies resolve on the very first install.

Pattern mirrors pulseengine/template-mcp-server
and the live @pulseengine/timedate-mcp-server package.

Deviations from the template

• Added linux-arm64. The template only ships linux-x64; rivet's
  existing release.yml already builds aarch64-unknown-linux-gnu via
  cross, so we publish that too.
• Workflow is decoupled from release.yml. The template's workflow
  also builds binaries — we only download the ones release.yml already
  produced, which keeps the existing release flow unchanged.
• execFileSync (no shell) for archive extraction in install.js
  instead of execSync string commands, to avoid any injection surface
  even though inputs are hardcoded.
• License: Apache-2.0 (matches workspace Cargo.toml), not MIT
  like the template.

Availability check

• @pulseengine/rivet — currently 404 on npmjs.org (available to claim).
• @pulseengine scope is already owned (@pulseengine/timedate-mcp-server
  is live under maintainer avrabe / ralf_beier@me.com).

Required repo configuration — ACTION REQUIRED

The publish workflow is gated on a repository secret named NPM_TOKEN.

I checked /repos/pulseengine/rivet/actions/secrets and it is currently
empty — the repo admin must add an automation NPM_TOKEN before the
first tag push will actually publish to npm. Until then the workflow will
start and fail at the npm publish step; it will not damage anything.

Non-goals

• Does not modify release.yml.
• Does not publish anything. Publishing only happens on tag push
  (v*) after release.yml creates the release and NPM_TOKEN is set.

Test plan

• Repo admin adds NPM_TOKEN secret (automation token from npmjs.com
  for the @pulseengine scope, publish permission).
• (Optional) Dry-run via workflow_dispatch against an existing tag
  to watch the publish steps before next release.
• First real tag push after merge publishes all six packages to npm.
• npm view @pulseengine/rivet shows the new version.
• npx @pulseengine/rivet --version prints the same string as
  cargo run -p rivet-cli -- --version.
• claude mcp add rivet npx -y @pulseengine/rivet mcp registers
  successfully and claude mcp list shows the server.
• Install on at least one Linux x64 and one macOS arm64 box to
  confirm optionalDependencies resolution.

[github-actions]

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Rivet Criterion Benchmarks'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.20.

Benchmark suite	Current: 7f79e35	Previous: deeafeb	Ratio
traceability_matrix/1000	58962 ns/iter (± 1194)	45303 ns/iter (± 1971)	1.30
query/10000	111090 ns/iter (± 2592)	92088 ns/iter (± 1491)	1.21

This comment was automatically generated by workflow using github-action-benchmark.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!