ci(napi): gate the npm publish behind an explicit dispatch input

[jamesyong-42]

The trap

napi-build.yml's header calls workflow_dispatch "useful for debugging", but its publish job had no condition. Every manual dispatch ran the full matrix and then attempted an npm publish. There was no way to exercise a build without reaching for the registry — which is why verifying the Windows-on-ARM target in #82 needed a throwaway probe workflow rather than just dispatching this one.

Change

• publish input (boolean, default false); publish job gated on if: ${{ inputs.publish }}
• release.yml passes -f publish=true, so release behaviour is unchanged
• Header target count corrected (stale at 5 since feat(napi): build a native binary for Windows on ARM #82)

Verification

Both directions were proven on this branch before the release side was wired, using a temporarily trimmed matrix and an echo in place of the publish command:

dispatch	Build	Test	Publish
no input	success	success	skipped
-f publish=true	success	success	success

PROBE: would run npm publish  (publish input evaluated TRUE)

That second run used the exact invocation release.yml issues, which is what confirms gh workflow run -f publish=true coerces to a boolean the if: condition accepts — the one thing that couldn't be reasoned about safely.

The trimmed matrix and the echo were reverted before this PR; the diff touches only the input, the condition, the release-side flag, and comments. Confirmed zero matrix entries removed.

Failure mode

If the -f publish=true flag is ever dropped from release.yml, the native package never reaches npm and the release stops at the existing Require @vibecook/spaghetti-sdk-native on npm gate, which already refuses to publish the SDK and CLI without it.

Loud and recoverable, not silent — no partial or broken release is possible.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LQt9EvHYXCd2U4ZJMfMm4E