fix(cli): abort install/uninstall when existing config cannot be parsed

[Dhravya]

Summary

• Abort install / uninstall when existing config.toml or hooks.json cannot be parsed, instead of rewriting from an empty object (fixes data-loss risk in Install/uninstall can overwrite Codex config when config parsing fails #33).
• Keep the normal path: parse the user's file, merge our keys in, write back.
• Apply the same fail-closed behavior when writing supermemory.json install defaults.
• Validate Codex config files before install/uninstall mutations begin.
• Publish to npm automatically on merges to main (patch bump + publish; no tag/release trigger).

Supersedes the approach in #34 with a simpler parse-and-merge + abort-on-parse-fail fix.

Test plan

• npm test (includes new regression tests)
• Manually: break ~/.codex/config.toml syntax → install exits non-zero and leaves the file untouched
• Manually: valid config with extra keys → install merges codex_hooks without dropping other settings
• After merge: confirm Publish Package workflow bumps patch, publishes to npm, and pushes chore(release): x.y.z
• Confirm npm trusted publishing is allowed for the main branch workflow (not only v* tags)

[Dhravya]

• fix(cli): abort install/uninstall when existing config cannot be parsed #35 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.