fix(npm): add registry fallback + sync package versions

[Shadow-Azure]

Problem

Users with Chinese npm mirror (registry.npmmirror.com) cannot install cli-box-skill when new versions are published, because the mirror has sync lag. The npm install fails with No matching version found for the platform packages (cli-box-darwin-arm64, cli-box-electron-darwin-arm64).

Additionally, the local package.json files in the packages/ directory were never updated after CI publishing — the release workflow updates versions during npm publish but never commits the changes back to the repository.

Solution

1. Postinstall registry fallback (47b0cff)

When the user's configured registry (e.g., npmmirror) doesn't have the required platform package version, the postinstall script now automatically falls back to installing from the official npmjs.org registry.

Flow:

npm install -g cli-box-skill
  → npm tries user's registry (npmmirror) for optionalDependencies
  → if not found, npm skips (optional)
  → postinstall runs ensureBinaries()
  → require.resolve() fails
  → fallback: npm install pkg@version --registry=https://registry.npmjs.org --no-save
  → success, continue normal flow

2. Sync package.json versions (7da1a8f)

Updated all packages/*/package.json to version 0.2.8 to match what's published on npm.

3. Auto-commit version changes in CI (2e50ace)

Added a step to .github/workflows/release.yml that commits the updated package.json versions back to the repository after npm publish, preventing future version drift.

Test Plan

• All 18 cli-box-skill unit tests pass
• Postinstall fallback logic tested: when platform package is missing, it attempts install from npmjs.org
• Release workflow change verified: version commit step added after npm publish

[github-actions]

🔒 门禁检查结果

检查项	状态
Rust 格式化	✅ success
Rust Clippy	✅ success
Rust 测试 & 覆盖率	✅ success
前端测试 & 覆盖率	✅ success
Playwright E2E	✅ success
统一测试 (test.sh)	✅ success
安全检查	✅ success

Rust 测试覆盖率

指标	覆盖率
行覆盖率	66.0%
分支覆盖率	0.0%

模块	行覆盖率
crates.cli-box-core.src.daemon	██████████░░░░░░░░░░ 50.7%
crates.cli-box-core.src.sandbox	███████████████████░ 98.8%
crates.cli-box-core.src.automation	███████████░░░░░░░░░ 58.3%
crates.cli-box-core.src	███████████░░░░░░░░░ 55.3%
crates.cli-box-core.src.instance	███████████████████░ 99.1%
crates.cli-box-core.src.process	██████████░░░░░░░░░░ 54.7%
crates.cli-box-core.src.server	█████████████████░░░ 87.7%
crates.cli-box-core.src.capture	████████████████████ 100.0%

详细报告见 Rust 覆盖率 artifact

前端测试覆盖率

指标	覆盖率
行覆盖率	███████████████░░░░░ 75.6%
分支覆盖率	65.7%
函数覆盖率	73.4%
语句覆盖率	75.0%

文件	行覆盖率
src/tests/mocks/websocket.ts	██████████████████░░ 88.0%
src/tests/mocks/xterm.ts	████████████████████ 100.0%
src/main/daemon-bridge.ts	████████░░░░░░░░░░░░ 40.0%
src/renderer/api.ts	██████████████░░░░░░ 68.2%
src/renderer/scrollback.ts	██████████████████░░ 88.9%
src/renderer/tabState.ts	████████████████████ 100.0%
src/renderer/terminalBuffer.ts	████████████████████ 100.0%

详细报告见前端覆盖率 artifact

✅ 所有检查通过，可以合入

点击 Squash and merge 合并此PR