feat: add npm build process, version bump, and forbidden token enforcement

- Add esbuild config to bundle CLI with all workspace code for npm publishing
- Add build-npm.sh script that runs forbidden token check, type-check,
  esbuild bundle, and generates publishable package.json
- Add generate-npm-package-json.mjs to resolve workspace:* refs to actual
  npm dependencies for publishing
- Add version-bump.sh for patch/minor/major/explicit version bumping
- Add check-forbidden-tokens.mjs that scans codebase for forbidden tokens
  (mirrors git hook logic, safe if token list is missing)
- Add esbuild as dev dependency
- Add build:npm, version:bump, check:tokens scripts to root package.json
- Update .gitignore for build artifacts

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cli/esbuild.config.mjs

@@ -0,0 +1,51 @@
+/**
+ * esbuild configuration for building the paperclipai CLI for npm.
+ *
+ * Bundles all workspace packages (@paperclipai/*) into a single file.
+ * External npm packages remain as regular dependencies.
+ */
+
+import { readFileSync } from "node:fs";
+import { resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = resolve(__dirname, "..");
+
+// Workspace packages whose code should be bundled into the CLI
+const workspacePaths = [
+  "cli",
+  "server",
+  "packages/db",
+  "packages/shared",
+  "packages/adapter-utils",
+  "packages/adapters/claude-local",
+  "packages/adapters/codex-local",
+  "packages/adapters/openclaw",
+];
+
+// Collect all external (non-workspace) npm package names
+const externals = new Set();
+for (const p of workspacePaths) {
+  const pkg = JSON.parse(readFileSync(resolve(repoRoot, p, "package.json"), "utf8"));
+  for (const name of Object.keys(pkg.dependencies || {})) {
+    if (!name.startsWith("@paperclipai/")) externals.add(name);
+  }
+  for (const name of Object.keys(pkg.optionalDependencies || {})) {
+    externals.add(name);
+  }
+}
+
+/** @type {import('esbuild').BuildOptions} */
+export default {
+  entryPoints: ["src/index.ts"],
+  bundle: true,
+  platform: "node",
+  target: "node20",
+  format: "esm",
+  outfile: "dist/index.js",
+  banner: { js: "#!/usr/bin/env node" },
+  external: [...externals].sort(),
+  treeShaking: true,
+  sourcemap: true,
+};

cli/package.json

@@ -6,7 +6,13 @@
   "bin": {
     "paperclipai": "./dist/index.js"
   },
-  "keywords": ["paperclip", "ai", "agents", "orchestration", "cli"],
+  "keywords": [
+    "paperclip",
+    "ai",
+    "agents",
+    "orchestration",
+    "cli"
+  ],
   "license": "MIT",
   "repository": {
     "type": "git",