feat: ship per-arch standalone binaries on each release

[ja-818]

Summary

Adds a release workflow that attaches single-file standalone link-cli binaries to every GitHub Release, plus a manifest.json with sha256 checksums and per-target download URLs. Targets: darwin-arm64, darwin-x64, linux-x64, windows-x64.

Motivation

We're shipping Houston (a desktop platform for non-technical founders to run AI agents) with Link as a first-class payments surface. Houston bundles three CLIs today (codex, composio, claude-code); for each we download a signed binary from upstream, sha256-verify, sign + notarize alongside our .app, and stage it into Contents/Resources/bin/. That works well because each upstream ships per-arch standalone binaries.

link-cli only ships on npm. Bundling a non-Node binary today means owning a bun build --compile (or pkg) pipeline per consumer, which means every consumer hitting the same packaging edges (the react-devtools-core resolution issue under ink, update-notifier external handling, viem's WASM + dynamic imports). Solving it once upstream is a much smaller surface than every agent platform doing it independently.

Tracking issue with full context: #72.

What this PR does

1. scripts/build-binary.ts: invokes Bun.build against the existing packages/cli/dist/cli.js entrypoint, with a tiny in-process plugin that stubs two optional deps (react-devtools-core is dynamically loaded by ink only when DEV=true; update-notifier is already external in tsup.config.ts). Output: dist-bin/link-cli-<target>[.exe].

2. scripts/generate-manifest.ts: walks dist-bin/, sha256s every binary, emits manifest.json with version, generated_at, and per-target { file, sha256, url }.

3. .github/workflows/release-binaries.yml: triggers on release.published (the event changesets/action fires on every npm publish). On a single Ubuntu runner, builds all four targets via Bun cross-compile, generates the manifest, and uploads everything to the existing release via gh release upload. workflow_dispatch is provided for manual rebuilds against an existing tag.

4. README.md: short "Standalone binaries" section under Installation pointing at the latest release + the manifest URL pattern.

5. .gitignore: adds dist-bin/.

Verification

Run locally on macOS arm64 (Bun 1.3.10, Node 22, pnpm 10.32):

pnpm install --frozen-lockfile
pnpm turbo run build
for t in darwin-arm64 darwin-x64 linux-x64 windows-x64; do
  bun run scripts/build-binary.ts $t
done
bun run scripts/generate-manifest.ts 0.4.2

Result on darwin-arm64 host:

• All four targets compile; total time < 10s after pnpm turbo run build.
• dist-bin/link-cli-darwin-arm64 --help and --version work.
• dist-bin/link-cli-darwin-arm64 mpp decode --challenge 'Payment id="ch_001", realm="merchant.example", method="stripe", intent="charge", request="..."' runs the viem-backed challenge decoder successfully (validation reaches the per-field "amount: missing" check, which is the expected behavior for an incomplete test challenge).
• Sizes (minified): darwin-arm64 60 MB, darwin-x64 64 MB, linux-x64 101 MB, windows-x64 111 MB. Linux/Windows are heavier because Bun ships more runtime polyfills for non-host targets.

CI gauntlet on this branch passes locally:

• pnpm biome check . — clean (96 files)
• pnpm turbo run typecheck — pass
• pnpm turbo run test — 100/100 pass
• pnpm turbo run build — pass

Notes

• I pinned Bun to 1.3.10 in the workflow to keep release outputs reproducible. Happy to change that to latest or whatever your team prefers.
• The script uses // @ts-expect-error on one line because the compile option is supported by Bun.build at runtime but not yet in the public TypeScript types.
• Stub plugin replaces module contents, not the import path, so the bundled output has no leftover references to either optional dep on disk.
• I haven't touched release.yml — the existing changesets-driven flow is unchanged. This new workflow is fully additive and runs after the release event the existing flow already produces.
• I'll sign the CLA on first comment.

Future work (not in this PR)

• Lazy-load viem inside mpp decode so the static bundle is smaller for non-MPP users (mentioned in the tracking issue).
• Linux arm64 + Windows arm64 if there's demand. Bun supports both targets; happy to add in a follow-up.

🤖 Co-authored with Claude Code.

[cla-assistant]

All committers have signed the CLA.

[ja-818]

Force-pushed with the correct git author email so the commit links to my GitHub account. Going to sign the CLA now.

[danhill-stripe]

doesn't this script need two params?