Create CLI release workflow

.github/workflows/release-cli.yaml

@@ -0,0 +1,45 @@
+name: "Release CLI"
+on:
+  push:
+    tags:
+      - "cli/v*"
+permissions:
+  contents: "write"
+  id-token: write
+jobs:
+  release:
+    # note: must use GitHub-hosted runner for publishing to NPM with --provenance flag
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Validate version"
+        if: ${{ !startsWith(github.ref_name, 'cli/v') }}
+        run: 'echo "Modus CLI version must start with `cli/v` && exit 1'
+      - uses: actions/checkout@v4
+        with:
+          ref: "${{ github.ref_name }}"
+      - name: Parse CLI Version
+        id: parse_cli_version
+        run: |
+          echo "cli_version=$(echo '${{ github.ref_name }}' | cut -d'/' -f 2)" >> $GITHUB_OUTPUT
+          echo "npm_tag=$(echo '${{ github.ref_name }}' | cut -d'/' -f 2 | sed -E 's/^[^-]+-([a-zA-Z]+).*/\1/ ; s/v.*/latest/')" >> $GITHUB_OUTPUT
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: ">=22"
+          registry-url: "https://registry.npmjs.org"
+      - name: Prepare Release
+        working-directory: cli
+        run: ./scripts/prepare-release.sh ${{ steps.parse_cli_version.outputs.cli_version }}
+      - name: Install Dependencies
+        working-directory: cli
+        run: npm ci
+      - name: Publish NPM Package
+        working-directory: cli
+        run: npm publish --provenance --access public --tag ${{ steps.parse_cli_version.outputs.npm_tag }}
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - name: Create Release
+        uses: softprops/action-gh-release@v2
+        with:
+          prerelease: ${{ contains(steps.parse_cli_version.outputs.cli_version, '-') }}
+          make_latest: false