ci: verify the bundled CLI command surface before publishing (#107)

`node bin/cli.mjs --version` passes on a bundle that has silently lost
commands. That is exactly how `supermemory local` disappeared in 5.0.0-rc.1:
the Speakeasy migration swapped the checked-in bin/cli for a bundle built
from the monorepo, the launcher shim went with it, and the publish smoke
test noticed nothing.

Runs the surface check the CLI owns in mono, which diffs the built bundle's
own `help --json` against a committed ledger of tracked commands. Against the
published 5.0.0-rc.3 artifact it fails with the missing `local`.

Requires supermemoryai/mono#3220.


Claude-Session: https://claude.ai/code/session_01XfVCx97GJvfMGzv88pVvNU

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: Dhravya

.github/workflows/publish-npm.yml

@@ -82,6 +82,10 @@ jobs:
           chmod +x bin/cli.mjs
           node bin/cli.mjs --version
 
+      - name: Verify CLI command surface
+        if: steps.meta.outputs.publish == 'true'
+        run: bun ../mono/apps/cli/scripts/verify-surface.ts "$(pwd)/bin/cli.mjs"
+
       - name: Verify tarball contents
         if: steps.meta.outputs.publish == 'true'
         run: |