feat: prepare CLI for first npm publish

- Fix prepublishOnly: remove lint/test (missing at package level, already
  run by CI at root before publish step)
- Add NODE_AUTH_TOKEN and --provenance to publish workflow
- Add separator below Features in README

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jarrodwatts

.github/workflows/publish.yml

@@ -27,4 +27,6 @@ jobs:
       - run: pnpm lint
       - run: pnpm test
       - run: pnpm build
-      - run: pnpm --filter @abstract-foundation/agw-cli publish --access public --no-git-checks
+      - run: pnpm --filter @abstract-foundation/agw-cli publish --access public --no-git-checks --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

README.md

@@ -27,6 +27,8 @@ Or, read the [installation guide](https://github.com/Abstract-Foundation/agw-cli
 - **Pagination & field trimming** — narrow reads with `fields`, paginate with `--page-all`
 - **Agent skills** — installable skills that teach AI agents safe CLI usage patterns
 
+---
+
 ### Prerequisites
 
 - Node.js 18+

packages/agw-cli/package.json

@@ -32,7 +32,7 @@
     "check-types": "tsc -p tsconfig.json --noEmit",
     "dev": "tsx src/index.ts",
     "start": "node dist/index.mjs",
-    "prepublishOnly": "pnpm check-types && pnpm lint && pnpm test && pnpm build"
+    "prepublishOnly": "pnpm check-types && pnpm build"
   },
   "dependencies": {
     "@abstract-foundation/agw-client": "1.10.0",