cli: add Go CLI (subtext binary + @fullstory/subtext-cli npm wrapper)

[jurassix]

What's in this PR

This adds a standalone Go CLI to the subtext repo under cli/. It replaces the previous internal-only Bazel build with a standard Go module, ships binaries via GoReleaser, and wraps them for npx consumption via @fullstory/subtext-cli.

The source was ported from the fullstory/mn monorepo (subtext/sightmap-upload-cmd@68b9093), which itself incorporates two completed feature branches:

• cli-format-flag — --format json/text flag, Go-native reverse tunnel client
• subtext/sightmap-upload-cmd — subtext sightmap upload command for uploading .sightmap/ definitions to a live session

No code logic was changed during the port — only import paths and build infrastructure.

---

What the CLI does

subtext is a terminal interface to the Subtext MCP server. It lets you drive the same tools an AI agent uses — live browser sessions, comments, proof documents, sightmap uploads — directly from a shell or CI script.

subtext live    connect | view navigate | view screenshot | act click | …
subtext comment list | add | reply | resolve
subtext doc     create | update | attach | close
subtext tunnel  connect | disconnect | status
subtext artifact upload | url
subtext sightmap upload
subtext auth    whoami

---

Structure

cli/
  cmd/subtext/main.go         entry point
  internal/
    auth/                     API key resolution
    cli/                      cobra commands (namespaces, call dispatch, render)
    config/                   config file (~/.config/subtext/config.yaml)
    mcpclient/                JSON-RPC MCP client + endpoint logic
    sightmap/                 .sightmap/ walker + HTTP upload
    tunnel/                   Go-native yamux reverse tunnel client
    fstesting/                local Ok/Equals/Assert test helpers (replaces internal mn package)
  npm/
    package.json              @fullstory/subtext-cli
    install.js                postinstall: downloads binary from GitHub Releases
    bin/subtext.js            thin spawnSync wrapper
  .goreleaser.yml             builds darwin/linux/windows × amd64/arm64
  RELEASING.md                step-by-step release guide
  README.md                   end-user install + usage docs

---

Distribution

Channel	How
npx @fullstory/subtext-cli	npm postinstall downloads binary from GitHub Releases
npm install -g @fullstory/subtext-cli	same
go install github.com/fullstorydev/subtext/cli/cmd/subtext@latest	standard Go toolchain
Download binary	GitHub Releases page

A new GitHub Actions workflow (.github/workflows/release-cli.yml) fires on cli-v* tags, runs tests, and calls GoReleaser to publish the GitHub Release. The npm publish step is gated behind a PUBLISH_NPM=true repo variable (pending @fullstory npm scope provisioning).

---

Before the first release

See cli/RELEASING.md for the full runbook. The two things that need to exist before tagging cli-v0.1.0:

1. NPM_TOKEN secret + PUBLISH_NPM=true repo variable (once @fullstory scope is provisioned)
2. That's it — homebrew tap omitted intentionally until the tap repo exists

---

Test plan

• go build ./... — clean
• go test ./... — all 6 packages pass
• GOOS=windows go build ./... — cross-compiles cleanly (Unix-specific tunnel code excluded via build tag)
• goreleaser release --snapshot --clean --skip=publish — all 6 OS/arch archives produced, subtext version prints the injected version string