Add published Action and npm smoke workflow

[jeffreyaven]

Summary

Adds a workflow that exercises the published artifacts the way a consumer does, and fixes a misleading verification step in the README.

Published Action smoke workflow

.github/workflows/published-action-smoke.yml, run on workflow_dispatch and weekly:

• action job: checks out the fixture at the v0 tag and runs stackql/mcp-wringer@v0 on ubuntu-latest, ubuntu-24.04-arm, macos-latest and windows-latest. A clean run must report zero findings; a defective run (exit-on-decode-error) must fail at fail_on: high. Reuses scripts/assert-action-output.mjs.
• npm job: same matrix, runs npx @stackql/mcp-wringer@latest from the registry against the same fixture (exit 0 clean, exit 1 defective), and checks that npm latest equals the tag's package.json version.

The self-test workflow covers the checked-out source; this one covers what users install.

README fix

During the 0.1.0 release the npx ... --help verification failed with 'mcp-wringer' is not recognized. Root cause: it was run inside the repository checkout, where npx matches the checkout's own package name and looks for a node_modules/.bin link that does not exist. The published package was fine (npm install in a scratch project and npx from another directory both work). The README now says to run the command from outside the checkout, and the smoke workflow does the same.

Docs

• Release steps and checklist: dispatch the smoke workflow after moving the v0 tag.
• docs/dev/ideas.md: three items from the StackQL CI integration (diagnostic when a run stops at durationMs before cases; accept a UTF-8 BOM in config files; a spec input on the Action).

Verification

• Both npm CLI commands behave as the workflow expects against the local fixture, run from outside the checkout on Windows.
• actionlint 1.6.23 reports only its outdated label list for ubuntu-24.04-arm; the repo does not run actionlint.
• Not verified: the workflow itself has not run. It needs the v0 tag, which exists, and is dispatched after merge.