Add deterministic tracked AI setup delivery

.github/workflows/ci.yml

@@ -0,0 +1,39 @@
+name: Validate
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v7
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Test
+        run: npm test
+
+      - name: Test packed artifact
+        run: npm run test:package

.github/workflows/release.yml

@@ -0,0 +1,71 @@
+name: Release package
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment: package-release
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Verify tag commit is on main
+        run: |
+          git fetch --no-tags origin main
+          git merge-base --is-ancestor "$GITHUB_SHA" origin/main || {
+            echo "Release tags must point to commits reachable from origin/main."
+            exit 1
+          }
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Verify tag matches package version
+        run: >-
+          node -e 'const p=require("./package.json");
+          if (process.env.GITHUB_REF_NAME !== "v" + p.version) {
+          console.error("Tag " + process.env.GITHUB_REF_NAME + " does not match package version " + p.version);
+          process.exit(1); }'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Test
+        run: npm test
+
+      - name: Test packed artifact
+        run: npm run test:package
+
+      - name: Pack release artifact
+        id: pack
+        run: |
+          FILENAME="$(npm pack --json | node -e 'const data=JSON.parse(require("fs").readFileSync(0,"utf8")); process.stdout.write(data[0].filename)')"
+          cp "$FILENAME" ca-ai-tools-setup.tgz
+          node -e 'const p=require("./package.json"); require("fs").appendFileSync(process.env.GITHUB_OUTPUT, "prerelease=" + (p.version.includes("-") ? "true" : "false") + "\n")'
+          echo "Packed $FILENAME as ca-ai-tools-setup.tgz"
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: ca-ai-tools-setup.tgz
+          generate_release_notes: true
+          prerelease: ${{ steps.pack.outputs.prerelease == 'true' }}

.gitignore

@@ -1,5 +1,6 @@
 node_modules/
 dist/
+.idea/
 .DS_Store
 coverage/
 metricinsights-*.tgz

AGENTS.md

@@ -51,7 +51,8 @@ node dist/cli.js --target ../some-other-repo --assistants cursor,claude --dry-ru
 **File overwrite policy (generator.ts):**
 
 - Setup assistant markdown files (`setup-cursor-assistant.md`, `setup-claude-assistant.md`) are always overwritten
-- `CLAUDE.md`, `.cursorrules`, `.cursor/skills/*`, `.claude/skills/*`, `.claude/settings.json`, `AGENTS.md`, `.dev-environment.md` — created on first run, skipped on subsequent runs unless `--force`
+- `CLAUDE.md`, `.cursorrules`, `.cursor/skills/*`, `.claude/skills/*`, `.claude/settings.json`, `.dev-environment.md` — created on first run, skipped on subsequent runs unless `--force`
+- Existing `AGENTS.md` is never replaced, including with `--force`; missing generated agent rows are merged while repository-owned content is preserved
 - Obsolete legacy QA paths (`ai-testing`, `ui-check` skills, `.claude/workflows/ui-check.md`) are removed on every re-run via `REMOVABLE_LEGACY_SETUP_PATHS`
 - MCP JSON files — interactive prompt (Skip/Merge/Overwrite) in interactive mode; left unchanged with `--yes`; fully replaced with `--force`
 

CLAUDE.md

@@ -50,7 +50,8 @@ node dist/cli.js --target ../some-other-repo --assistants cursor,claude --dry-ru
 **File overwrite policy (generator.ts):**
 
 - Setup assistant markdown files (`setup-cursor-assistant.md`, `setup-claude-assistant.md`) are always overwritten
-- `CLAUDE.md`, `.cursorrules`, `.cursor/skills/ui-check/SKILL.md`, `.claude/skills/ui-check/SKILL.md`, `.claude/settings.json`, `AGENTS.md`, `.dev-environment.md` — created on first run, skipped on subsequent runs unless `--force`
+- `CLAUDE.md`, `.cursorrules`, `.cursor/skills/ui-check/SKILL.md`, `.claude/skills/ui-check/SKILL.md`, `.claude/settings.json`, `.dev-environment.md` — created on first run, skipped on subsequent runs unless `--force`
+- Existing `AGENTS.md` is never replaced, including with `--force`; missing generated agent rows are merged while repository-owned content is preserved
 - MCP JSON files — interactive prompt (Skip/Merge/Overwrite) in interactive mode; left unchanged with `--yes`; fully replaced with `--force`
 
 ## Testing