feat(release): nx release pipeline with npm provenance for v1 packages

[blove]

Summary

Stands up the complete release pipeline for v1 publish of @cacheplane/angular, @cacheplane/render, @cacheplane/chat. Implements the plan at docs/superpowers/plans/2026-04-18-release-infrastructure.md.

What's in

• Conventional commits enforced — commitlint + husky locally (.husky/commit-msg), CI check on PRs (.github/workflows/commitlint.yml). Scope is required and restricted to the repo's surface area.
• Nx Release configured — independent per-package versioning, tag format <pkg>@v<version>, auto-update of internal peer dep ranges (preserveMatchingDependencyRanges: false + updateDependents: always), Keep-a-Changelog per library, GitHub Release creation.
• Publishing pipeline — new .github/workflows/release.yml triggered on agent@v* / render@v* / chat@v* tags, publishes with npm provenance via OIDC. Old publish.yml removed.
• Local smoke test — scripts/verify-release-local.sh runs the full pipeline against a local Verdaccio registry in under a minute.
• Operator runbook — docs/release-runbook.md with standard release flow, --first-release note, manual dispatch recovery path, troubleshooting, and version policy.

What's out of scope (follow-up plans)

• License public-key embedding at build time + license-test fixtures in CI → licensing plan
• @cacheplane/chat peer deps on the non-v1 @cacheplane/a2ui + @cacheplane/partial-json → chat stabilization plan

Notable implementation deviations from plan

• Nx 22 schema placement — preserveMatchingDependencyRanges and updateDependents live at version.* level, not inside generatorOptions as the plan text suggested.
• Build step on tag-push path — added explicit nx run-many -t build step in release.yml (caught in final review; plan had implicit build assumption).
• scope-empty: 'never' — added to commitlint to match the "scope required" intent the comment claimed.
• --first-release guidance — added to runbook step 2 after dry-runs surfaced the missing-tag warning.

Test plan

• Local smoke (./scripts/verify-release-local.sh) passes end-to-end
• nx release version --dry-run proposes correct bumps (0.0.1 → 0.1.0 for all three libs)
• Commitlint hook rejects bad commits, accepts conventional ones
• scope-empty: never rejects scope-less commits
• PR-level commitlint CI run passes (will validate when this PR opens)
• Manual workflow dispatch with `dry-run: true` succeeds on merge to main (post-merge validation)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cacheplane	Ready	Preview, Comment	Apr 19, 2026 5:56pm

[blove]

Closing as obsolete. The npm scope rename @cacheplane → @Ngaf, package restructure (libs/agent removed), and the publish.yml + nx release setup that landed via subsequent PRs together supersede the work in this PR. The release pipeline is now operational on main (currently shipping at @ngaf/* 0.0.28). If commitlint/husky or the verdaccio smoke harness become priorities, they can be revived from this PR's history as standalone changes.