feat(cli): add npm-managed distribution and updates

[Grivn]

Summary

• add the public @mnemon-dev/mnemon CLI meta-package and six macOS, Linux, and Windows native variants using the same version-alias model as Codex
• add a fail-closed mnemon update path that verifies the owning npm prefix and lets the JavaScript launcher perform replacement without holding the native executable open on Windows
• extend tagged releases to stage, verify, and publish immutable platform versions before advancing the latest or next CLI tag, with retry-safe partial publication
• make npm the canonical install path in English and Chinese docs and generated OpenClaw/NanoClaw guidance

Release model

GoReleaser remains the only native build matrix. The npm release job consumes its artifacts.json and exact binaries, dry-runs every package, launches the host binary through the staged package, and publishes the CLI meta-package last. The workflow supports npm trusted publishing via OIDC while retaining NPM_TOKEN only for the first package bootstrap.

Validation

• make test
• npm test --prefix npm/cli
• actionlint on CI and release workflows
• CGO-disabled cross-builds for darwin/linux/windows on amd64 and arm64
• staged seven-package npm pack and native launcher smoke test
• end-to-end launcher update test with an isolated global prefix

One-time rollout after merge

1. Reserve the @mnemon-dev scope and add a granular NPM_TOKEN secret for the first tagged release.
2. Publish the first tag; the workflow creates the platform versions and meta-package.
3. Configure @mnemon-dev/mnemon trusted publishing for mnemon-dev/mnemon, workflow release.yml, with direct npm publish allowed.
4. Confirm OIDC on the next tag, then delete the repository secret and revoke the bootstrap token.