Attach a prebuilt package tarball to release tags

[jstet]

What

Attach a prebuilt tarball of this package to each release tag, so a consumer can install a specific version without the git-clone-and-build path.

Why, now that #3 is fixed

#3 removed the blocker (xlsx no longer resolves from a CDN URL), and a fresh npm install "git+…#main" now succeeds and builds dist/ via the prepare script. So this is no longer about being able to install — it is about not having to build at install time:

• Build cost on every consumer install. prepare runs tsc over ~50 modules in every consumer, in every CI run, on every deploy. CorrelAid/formtransform-app and CorrelAid/formulaid deploy through nixpacks with bun install --frozen-lockfile; both pay it.
• Environments that block install scripts. A policy that disallows lifecycle scripts (npm's allowScripts, --ignore-scripts, some corporate mirrors) yields a package with no dist/ at all, and the failure is an unresolved-entry error at bundle time rather than at install. That is the shape of the original tsc build does not emit dist/generated/conventions.json — prepare script leaves dist incomplete #1 report.
• devDependencies at install time. Building requires TypeScript in the consumer's dependency tree resolution for this package; a prebuilt artifact needs none of it.

Shape

A workflow on tag push that runs npm ci && npm run build && npm pack, then attaches the resulting correlaid-formtransform-<version>.tgz to the GitHub release. Consumers pin the asset URL instead of the git ref:

"@correlaid/formtransform": "https://github.com/CorrelAid/formtransform/releases/download/v1.0.0/correlaid-formtransform-1.0.0.tgz"

.github/workflows/worker-image.yml already publishes the schematron-worker image on a tag, so the release trigger and permissions pattern exist to copy.

Points to settle while implementing:

• Version source. package.json is at 0.1.0 and no tags exist yet. Decide whether the tag drives the version or vice versa, and whether the release job asserts they match.
• One artifact or two. The generated skills/cdl-survey-types/ sub-skill has the same problem from a different angle: CorrelAid/formulaid currently vendors it with git archive against a pinned SHA (its issue Emit QUESTION_TYPES with as const so per-key typeStrings survive into the .d.ts #9), which means it has to know this repo's directory layout, and a rename here breaks its build with a 404. A second asset — the sub-skill as its own tarball — would give it a stable URL. Cheap to add in the same job.
• Do not commit dist/ as an alternative. @correlaid/cdl-design does that, and it works, but it puts build output in review diffs and lets the committed artifact drift from src/. A release asset gives the same benefit with the build pinned to a tag.

Not urgent

Nothing is broken without this. It is a cost and robustness improvement, and it removes the last reason a consumer would need to know that this package builds itself on install.

Raised from CorrelAid/formulaid issue #12, which tracks the consumer side.