feat(release): add scripts/release.sh single-command release flow

[George-iam]

Summary

Single-command release script. Eliminates the manual ritual that caused 5 retries during v0.2.7 release.

Usage

```bash
./scripts/release.sh patch # 0.2.7 → 0.2.8
./scripts/release.sh minor # 0.2.7 → 0.3.0
./scripts/release.sh major # 0.2.7 → 1.0.0
./scripts/release.sh patch --dry-run
```

What it does

1. Preflight (fail-fast before any work): tools present, clean tree, on main + in sync, npm whoami, gh auth, lint+test+build all pass, CHANGELOG has `[X.Y.Z]` section per D-128
2. Bump version in 3 files in lockstep: `package.json`, `.claude-plugin/plugin.json`, `templates/plugin-README.md`
3. Open release PR with body from CHANGELOG, push, wait for user to merge
4. After merge: pull main, tag, push tag (triggers chained release-binary workflow)
5. Watch workflow with `gh run watch --exit-status`, fail loudly with run URL if anything broke
6. Postflight verify: npm version, GitHub release assets, plugin repo plugin.json — print summary

Idempotent: re-running after a partial failure recognizes existing branch/tag and continues.

What this fixes vs v0.2.7 release

v0.2.7 failure	How script prevents it
npm publish 401 (not logged in)	Preflight runs `npm whoami` first
Forgot to bump badge in plugin-README	Lockstep bumps all 3 version files
GitHub Actions anti-recursion broke chain	PR #99 already fixed; script just trusts the chained workflow
Wrong clone path (/tmp vs ~/axme-workspace)	Script never clones — works in repo root
No verification that all artifacts landed	Postflight checks npm + GitHub + plugin repo
CHANGELOG entries skipped (0.2.1-0.2.6 gap)	Aborts unless CHANGELOG has `[X.Y.Z]` section (D-128 enforcement)

Smoke test

Locally tested: preflight correctly aborts when working tree is dirty. Full end-to-end will be validated on v0.2.8.

Files

• `scripts/release.sh` (new, executable)
• `README.md` — Releasing section pointing to the script

Closes

B-004 (backlog)

🤖 Generated with Claude Code