feat: npm publish pipeline + package versioning (0.0.1-alpha.1)

Publish pipeline:
- Add publish-npm step to .woodpecker/publish.yml — publishes all
  @mosaic/* packages to Gitea npm registry on main push/tag
- Requires gitea_npm_token Woodpecker secret (package:write scope)
- publish-npm runs after build, parallel with Docker image builds
- pnpm publish resolves workspace:* to concrete versions automatically

Package configuration:
- All 20 packages versioned at 0.0.1-alpha.1
- publishConfig added to all packages (Gitea registry, public access)
- files field added to all packages (ship only dist/)
- @mosaic/forge includes pipeline/ assets in published package

Meta package (@mosaic/mosaic):
- Now depends on @mosaic/forge, @mosaic/macp, @mosaic/prdy,
  @mosaic/quality-rails, @mosaic/types
- npm install @mosaic/mosaic pulls in the standalone framework

Build fixes:
- Fix forge and macp tsconfig rootDir: '.' -> 'src' so dist/index.js
  resolves correctly (was dist/src/index.js)
- Exclude __tests__ and vitest.config from build includes
- Clean stale build artifacts from old rootDir config

Required Woodpecker secret:
  woodpecker secret add mosaic/mosaic-stack \
    --name gitea_npm_token --value '<token>' \
    --event push,manual,tag

plugins/mosaic-framework/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mosaic/oc-framework-plugin",
-  "version": "0.1.0",
+  "version": "0.0.1-alpha.1",
   "type": "module",
   "main": "src/index.ts",
   "description": "Injects Mosaic framework rails, runtime contract, and active mission context into all OpenClaw agent sessions and ACP subagent spawns.",
@@ -11,5 +11,12 @@
   },
   "devDependencies": {
     "openclaw": "*"
-  }
+  },
+  "publishConfig": {
+    "registry": "https://git.mosaicstack.dev/api/packages/mosaic/npm/",
+    "access": "public"
+  },
+  "files": [
+    "dist"
+  ]
 }