Add workflow_dispatch prerelease publish for cua-cli

[rgarcia]

Summary

Adds .github/workflows/prerelease-cua-cli.yml — a manually-triggered workflow to publish a prerelease of @onkernel/cua-cli from any branch, so unmerged work can be exercised via a normal npm install.

• Trigger: workflow_dispatch with a dist_tag input (default ext).
• Version: publishes <pkg-version>-<dist_tag>.<run_number> (unique per run) under the chosen dist-tag, never latest — normal npm install @onkernel/cua-cli is unaffected.
• No on-main gate (that's the point) — unlike release-cua-cli.yml.
• Builds cua-ai/cua-agent/cua-cli, verifies the runtime deps are already published, packs, runs the bin smoke test, then npm publish --tag <dist_tag>.
• Lean: skips the ptywright native (Zig) build — it's a test-only devDependency, not needed to build/pack/publish the CLI.

Once published: npm install -g @onkernel/cua-cli@<dist_tag>.

Two one-time setup steps (required before first run)

1. Merge this to main. workflow_dispatch workflows are only dispatchable if they exist on the default branch. After merge, "Run workflow" appears under Actions and you can point it at any branch.
2. Authorize npm publishing. It publishes via OIDC trusted publishing (same mechanism as release-cua-cli.yml), so add this workflow as a trusted publisher for @onkernel/cua-cli on npmjs.com: repo kernel/cua, workflow prerelease-cua-cli.yml. (Alternatively, swap the publish step to a granular NPM_TOKEN secret — say the word and I'll wire that instead.)

Usage

Actions → Prerelease CUA CLI → Run workflow → pick the branch (e.g. hypeship/harness-extension-host) → set dist_tag → Run. Then npm i -g @onkernel/cua-cli@<dist_tag>.

Test plan

• Merge to main, add the trusted publisher
• Dispatch against hypeship/harness-extension-host with dist_tag=ext
• npm i -g @onkernel/cua-cli@ext and confirm cua --help shows --self-extend / --no-extensions

🤖 Generated with Claude Code