feat(publish): reconstruct opencode-stable publish pipeline + CI (Plan B)

[ranxianglei]

Summary

Reconstructs the fork-specific publish infrastructure that was overwritten by an upstream sync (documented in the new AGENTS.md §4.5). This is Plan B from issue #5: a fork-specific CI pipeline on this mirror that publishes opencode-stable to npm, triggered by tags.

Closes the blocker that prevented a clean 1.14.42 release: the existing build.ts / publish.ts / postinstall.mjs were upstream's versions producing the wrong package names (opencode-ai, opencode-{platform}) — running them would attempt to publish sst-owned packages and fail.

Changes

docs(agents): add fork-level AGENTS.md (feac1fed2)

• Comprehensive fork spec modeled on opencode-acp's AGENTS.md: project overview, architecture, the OPENCODE_VERSION session-invalidation pitfall, storage/data safety, 3-remote layout, broken-publish-infra history, snapshot-fix divergence log, git safety rules, mandatory pre-publish checklist.

feat(publish): reconstruct opencode-stable publish pipeline + CI (bc7f17269)

• build.ts: platform package names get -stable suffix; platform package.json enriched (description / files / license to match what's published at 1.14.41); new --no-windows flag (the fork ships no Windows packages).
• publish.ts: umbrella = opencode-stable with full metadata + stub bin/opencode.exe (postinstall overwrites it with the real platform binary); filters Windows binaries; drops upstream's Docker / AUR / Homebrew steps (those target anomalyco/* infrastructure and would fail here).
• postinstall.mjs: restored verbatim from the published opencode-stable@1.14.41 tarball — the full avx2/musl/baseline fallback logic for resolving the correct platform binary (the upstream version that overwrote it had no -stable names and no fallback).
• .github/workflows/publish-stable.yml (new): tag-triggered (v*) workflow, gated to this repo, single ubuntu job → builds 9 cross-compile targets (--no-windows) → publishes via NPM_TOKEN secret.

Verification

• bun run typecheck (tsgo --noEmit) → exit 0, 0 errors
• publish-stable.yml validated as YAML
• postinstall.mjs syntax valid (node parse)
• build.ts region + publish.ts reviewed end-to-end

To release 1.14.42 (after this merges)

1. Add the NPM_TOKEN secret to this repo (Settings → Secrets → Actions). The token must have publish rights for opencode-stable + the 9 opencode-*-stable packages (owner: ranxianglei).
2. Merge this PR.
3. Tag and push:

   git tag -a v1.14.42 -m "release v1.14.42"
   git push origin v1.14.42

4. Watch the publish-stable workflow build the 9 binaries and publish 10 packages (1 umbrella + 9 platform).

⚠️ No --single flag in CI — it cross-compiles all 9 targets. The OPENCODE_VERSION env var is set from the tag so existing sessions stay valid.

[github-actions]

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

• PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.