feat: add npm build process, version bump, and forbidden token enforcement

- Add esbuild config to bundle CLI with all workspace code for npm publishing
- Add build-npm.sh script that runs forbidden token check, type-check,
  esbuild bundle, and generates publishable package.json
- Add generate-npm-package-json.mjs to resolve workspace:* refs to actual
  npm dependencies for publishing
- Add version-bump.sh for patch/minor/major/explicit version bumping
- Add check-forbidden-tokens.mjs that scans codebase for forbidden tokens
  (mirrors git hook logic, safe if token list is missing)
- Add esbuild as dev dependency
- Add build:npm, version:bump, check:tokens scripts to root package.json
- Update .gitignore for build artifacts

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitignore

@@ -12,8 +12,9 @@ data/
 tmp-*
 cli/tmp/
 
-# Scratch/seed scripts
+# Scratch/seed scripts (but not scripts/ dir)
 check-*.mjs
+!scripts/check-*.mjs
 new-agent*.json
 newcompany.json
 seed-*.mjs
@@ -21,6 +22,9 @@ server/check-*.mjs
 server/seed-*.mjs
 packages/db/seed-*.mjs
 
+# npm publish build artifacts
+cli/package.dev.json
+
 # Build artifacts in src directories
 server/src/**/*.js
 server/src/**/*.js.map