fix(ci): chain npm publish + plugin sync into release-binary workflow

[George-iam]

Problem

For v0.2.7 release the binaries got built and uploaded to GitHub Releases, but npm publish never ran and the plugin repo was not synced. The chain was broken by a documented GitHub Actions safety:

Events fired by GITHUB_TOKEN (anti-recursion protection) do NOT trigger downstream workflows.

So the previous setup was:

• `release-binary.yml` triggers on `push: tags: v*`, builds binaries, creates GitHub Release via `softprops/action-gh-release` using `GITHUB_TOKEN`
• `npm-publish.yml` triggers on `release: published` — never fires for releases created by GITHUB_TOKEN

Releases v0.2.3-v0.2.6 worked because the user manually created the GitHub Release in the UI after the binary build, which counts as a non-bot event and triggered the chain. v0.2.7 went via the bot path and broke.

Fix

Collapse `npm-publish.yml` into `release-binary.yml` as two `needs:`-chained jobs in the same workflow run:

```
build (4 matrix jobs)
↓
release (creates GitHub Release with binaries)
↓
publish-npm (npm ci + lint + test + npm publish)
↓
sync-plugin-repo (clones axme-code-plugin, copies dist/plugin/, pushes)
```

Same workflow = same run = no cross-workflow trigger needed. Single source of truth: push a v* tag, get all four artifacts.

Files

• `.github/workflows/release-binary.yml` — added `publish-npm` and `sync-plugin-repo` jobs
• `.github/workflows/npm-publish.yml` — deleted

Impact

• Identical user-facing behavior on next release: binaries + npm + plugin repo sync
• One trigger instead of two (push tag)
• No more silent breakage when bot creates the release

Test plan

• Merge this PR
• Manually publish v0.2.7 to npm (one-time, since this PR doesn't backfill the missed run)
• On next release tag push, verify all four jobs run in sequence and complete successfully

Notes

• `secrets.NPM_TOKEN` and `secrets.PLUGIN_REPO_TOKEN` are already configured (used by the deleted workflow), no secret updates needed.
• This is a reactive fix — root cause discovered when v0.2.7 release skipped npm publish.

🤖 Generated with Claude Code