Unify CLI release and prerelease publishing

[rgarcia]

Summary

• add a manual prerelease path to the existing release-cua-cli.yml trusted-publishing workflow
• preserve the production tag-on-main, native build, full CLI test, and default publish path
• bundle branch-built cua-ai and cua-agent into prerelease tarballs so cross-workspace changes are exercised
• remove the separate prerelease workflow

Why

npm permits one trusted GitHub Actions workflow per package. Keeping both publish paths in release-cua-cli.yml lets them share the existing OIDC publisher identity while the manual path rejects latest and publishes only under an explicit prerelease dist-tag.

Testing

• actionlint .github/workflows/release-cua-cli.yml
• built cua-ai, cua-agent, and cua-cli
• staged the manual-dispatch tarball with bundled workspace packages
• installed the tarball into a clean temporary project and passed the CLI bin smoke test

The npm publish step was not run locally.

---

Note

Medium Risk
Touches npm publish and OIDC release automation; prerelease path skips production-only gates (ptywright build, unit tests) and publishes bundled workspace versions under custom dist-tags.

Overview
Merges CLI prerelease publishing into release-cua-cli.yml and deletes prerelease-cua-cli.yml so npm trusted publishing uses a single workflow per package.

Production path (push on cua-cli/v* tags) is unchanged in spirit: tag-on-main, package version vs tag check, Zig/ptywright native build, dependency checks against npm, CLI unit tests, workspace pack, and default npm publish.

Manual prerelease path (workflow_dispatch with a non-latest dist_tag) bumps the CLI to <base>-<dist-tag>.<run-number>, skips native ptywright build and full CLI tests, packs branch-built @onkernel/cua-ai and @onkernel/cua-agent into the CLI tarball via bundledDependencies, smoke-tests install including bundled paths, and publishes with --tag <dist_tag>. Concurrency groups now include github.event_name so tag and manual runs do not collide incorrectly.

^{Reviewed by Cursor Bugbot for commit 1fc5754. Bugbot is set up for automated code reviews on this repo. Configure here.}