feat(cli): extract Obelisk runtime into npm package

Add @obelisk-apps/cli with the existing build, search, query, and attune contract plus official skill installation.

Separate the docs-only skill artifact, bootstrap installer, release layout, cross-platform CI, and package-level regression coverage.

docs/adr/0004-skill-artifact-readable-not-bundled.md

@@ -1,22 +1,21 @@
-# The skill artifact ships readable compiled JS, deliberately not bundled
+# The CLI ships readable compiled JS; the skill remains docs-only
 
 **Context.** Obelisk reads a user's entire local Claude Code and Codex history,
-so auditability is the foundation of trust: before a user lets the skill loose on
-their data, they must be able to read what it does. The obvious way to shrink a
-clone-and-run skill artifact is to bundle/minify Core into a single `runtime.js`,
-but that ships an opaque blob into `.claude/skills` / `.agents/skills`. The
-"don't drag the whole repo into the user's skills dir" concern is real but
-separate — it is solved by shipping *only Core*, not by bundling.
+so auditability is the foundation of trust. Bundling/minifying Core into one
+opaque file would make the runtime harder to inspect. Shipping executable Core
+inside `.claude/skills` / `.agents/skills` would also blur the boundary between
+the agent's instructions and the local data runtime.
 
-**Decision.** The skill artifact ships **readable, non-bundled, non-minified**
+**Decision.** `@obelisk-apps/cli` ships **readable, non-bundled, non-minified**
 compiled JavaScript emitted straight from `tsc` (module structure and comments
-preserved, ~1:1 with the TypeScript source), plus `schema.sql`, `SKILL.md`, and
-`references/`. It excludes `app/`, `release/`, `renderer/`, Electron code, and
-`tests/`, which is what keeps it small. Bundling into one file is deliberately
-rejected: it trades auditability for marginal size, the wrong trade for a
-history-reading tool. The public TS source in the main repo allows cross-checking.
+preserved, ~1:1 with the TypeScript source), plus `schema.sql`. It excludes the
+app, renderer, release assets, and tests. The separately published agent skill
+ships only `SKILL.md`, `references/`, and metadata; every executable action in
+the skill delegates to the installed `obelisk` command. Bundling into one file
+is deliberately rejected because it trades auditability for marginal size.
 
-**Consequences.** The installed skill is a few readable files rather than one
-blob; a future contributor may be tempted to "optimize" by bundling — this ADR
-records that the un-bundled form is intentional. Small artifact size comes from
-scoping the artifact to Core, handled by `build:skill`, not from a bundler.
+**Consequences.** Runtime ownership is unambiguous: npm installs the CLI, while
+the skills installer installs only agent guidance. A future contributor may be
+tempted to re-embed Core in the skill or bundle the CLI — this ADR records that
+both are intentional boundaries. `build:cli` owns compiled code;
+`build:skill` owns docs-only packaging.