phase 2: stand up @stackbilt/build in new Stackbilt-dev/stackbilt-build repo #125

Phase 2 of RFC #112 — relocate the commercial CLI surface (run, architect, scaffold, login) from @stackbilt/cli into a new @stackbilt/build npm package housed in a new GitHub repo.

Context

• Receiving repo decision locked 2026-04-17 → new Stackbilt-dev/stackbilt-build (see RFC: Extract commercial surface from @stackbilt/cli into @stackbilt/build #112 locking comment and AEGIS wiki decision page extract-stackbilt-build-new-repo).
• Phase 1 (env-var bridge) shipped in feat(cli): STACKBILT_API_KEY env var auth; deprecate charter login #111 as part of v0.11.0.

Scope

1. Create the repo Stackbilt-dev/stackbilt-build (public, Apache-2.0).
2. Port files from @stackbilt/cli:
   • packages/cli/src/commands/{login,architect,run,scaffold}.ts
   • packages/cli/src/credentials.ts, http-client.ts
   • packages/cli/src/types/scaffold-contract-types.ts (vendored)
   • Tests: credentials.test.ts, login.test.ts, auth-wiring.test.ts
3. Package naming: @stackbilt/build on npm, stackbilt bin alias.
4. Replicate release infra: charter's release.yml with npm trusted-publisher OIDC (see ci(release): publish to npm on tag push #118 through ci(release): upgrade npm to 11+ for trusted-publisher OIDC auth #121 for the full end-state pattern; notably: npm 11+ upgrade step, no registry-url, no NODE_AUTH_TOKEN).
5. Configure npm trusted publishers on @stackbilt/build before first publish.
6. Initial version: resolve Open Q feat(setup): add docs/planning preset for non-code workspaces (ADX-006) #3 (start at 0.1.0 vs. match charter's current minor) before first publish.
7. New repo README: reclaim the stackbilt run hero + scaffolding visuals that were removed from charter in docs: lead README with governance; remove build-hero + images #124.

Acceptance criteria

• Stackbilt-dev/stackbilt-build repo exists, public, Apache-2.0.
• @stackbilt/build on npm at initial version, installable globally.
• stackbilt run "..." end-to-end against the engine, installed via the new package.
• All tests pass in new repo's CI.
• Release workflow uses OIDC trusted-publisher auth. Provenance attestations attached to published tarballs.

Out of scope (tracked separately)

• Phase 3 — stronger CLI deprecation notice in charter.
• Phase 4 — full removal of the 4 commands from @stackbilt/cli at Charter 1.0.

References

• RFC RFC: Extract commercial surface from @stackbilt/cli into @stackbilt/build #112 (parent umbrella)
• AEGIS wiki: extract-stackbilt-build-new-repo (decision)
• Phase 1 shipped: feat(cli): STACKBILT_API_KEY env var auth; deprecate charter login #111 (env-var bridge, v0.11.0)