fix: prepare first release publication (#46)

Author: Telli

.github/workflows/release.yml

@@ -132,9 +132,21 @@ jobs:
       - name: Push to NuGet
         env:
           NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
-        run: dotnet nuget push 'release/*.nupkg' --api-key "$NUGET_API_KEY" --source https://api.nuget.org/v3/index.json --skip-duplicate
+        run: |
+          if [ -z "$NUGET_API_KEY" ]; then
+            echo '::error::Configure the NUGET_API_KEY Actions secret before publishing.'
+            exit 1
+          fi
+          dotnet nuget push 'release/*.nupkg' --api-key "$NUGET_API_KEY" --source https://api.nuget.org/v3/index.json --skip-duplicate
       - name: Create GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
           RELEASE_TAG: ${{ github.ref_name }}
-        run: gh release create "$RELEASE_TAG" release/* --verify-tag --generate-notes --title "$RELEASE_TAG"
+          RELEASE_VERSION: ${{ needs.validate.outputs.version }}
+        run: |
+          flags=()
+          if [[ "$RELEASE_VERSION" == *-* ]]; then
+            flags+=(--prerelease --latest=false)
+          fi
+          gh release create "$RELEASE_TAG" release/* --verify-tag --generate-notes --title "$RELEASE_TAG" "${flags[@]}"

docs/binary-distribution.md

@@ -35,3 +35,5 @@ pwsh -File .github/scripts/Test-Binary.ps1 -Runtime osx-arm64 -Version 0.1.0-pre
 Smoke tests validate the checksum and three-file archive, unpack into a clean directory, start `version` with an empty PATH and isolated runtime roots, run offline non-.NET commands and SQLite index state, then launch the relocated executable from real SDK MCP clients. Those clients exercise read-only denials, semantic evaluation, reversible rename, and actual build/TRX test results. The installed SDK is used only for the SDK-dependent acceptance portion.
 
 The release workflow validates build, tests, scenarios, documentation, dependency audit, and local NuGet installation before binary jobs. NuGet push and GitHub release assembly wait for all six native smoke jobs. Local success does not prove the other platform jobs have run. No release is created until a version tag triggers the gated workflow.
+
+Before pushing the first version tag, configure the `NUGET_API_KEY` Actions secret at repository scope or in the `nuget` environment with permission to publish all `SharpClaw.Code*` packages. A missing key fails publication with an explicit error after artifact validation. After configuring the key, rerun failed jobs on the same tagged workflow to retain the validated artifacts. Tags with prerelease versions, such as `v0.1.0-preview.1`, create GitHub prereleases.