feat(dist): add npx agentdiff and make every install path work

[lostmartian]

What

AgentDiff can now be run with whatever the machine already has:

You have	Run once	Install
Node 18+	npx agentdiff (new)	npm i -g agentdiff
uv	uvx --from agent-trajectory-diff agentdiff	uv tool install agent-trajectory-diff
pipx	pipx run --spec agent-trajectory-diff agentdiff	pipx install agent-trajectory-diff
Python 3.10+		pip install agent-trajectory-diff
Claude Code	/agentdiff:report (now works without uv)	/plugin install agentdiff --marketplace kerrshift/agentdiff

Why

Distribution is the main lever for reach (roadmap P1.2/P1.7). Before this PR, the Claude Code plugin needed uv or a pre-installed agentdiff, and there was no npx route for the many Claude Code users who have Node but not uv.

How

npm/: the agentdiff npm package. It has zero dependencies and is 2.4 kB packed.

• bin/agentdiff.js runs agent-trajectory-diff==<its own version>, trying in order:
  1. uvx;
  2. pipx run (warmed silently first);
  3. a private virtualenv built once in ~/.cache/agentdiff/venv-<version> (%LOCALAPPDATA% on Windows) with any Python 3.10+;
  4. otherwise it prints what to install.
• It passes stdio straight through and keeps the CLI's exit code.

Plugin report.sh: gains the same pipx and plain-Python fallbacks. It still always exits 0, so the skill never aborts.

Release and CI:

• New publish-npm job in publish.yml:
  • runs after PyPI, so npx always resolves to an uploaded release;
  • checks that npm/package.json matches the tag;
  • runs the launcher tests;
  • runs npm publish --provenance.
• If the NPM_TOKEN secret isn't set, the job skips the npm upload with a warning instead of failing the release.
• CI gets an npm launcher job.

Version sync: tests/test_distribution.py (renamed from test_claude_plugin.py) now also checks that npm/package.json matches __version__. AGENTS.md's release rule says to bump the npm and plugin versions together.

Testing

make lint                                        -> All checks passed
uv run python -m pytest                          -> 461 passed
cd npm && npm test                               -> 4 passed (uvx / pipx / venv-once / nothing installed)
claude plugin validate --strict . (CLI 2.1.303)  -> ✔ Validation passed

End to end against the real PyPI 0.6.0 and my real logs:

• npm package as published: npm pack, then npx ./agentdiff-0.6.0.tgz. It printed the report through uvx, and again on a PATH with only Python 3.14, which built a venv and reused it on the second run.
• Plugin script: printed the report through each fallback (installed agentdiff, uvx, pipx, Python only). With nothing available it printed install help and exited 0.
• Merged plugin:
  • installed from GitHub (/plugin install agentdiff --marketplace kerrshift/agentdiff) into an isolated CLAUDE_CONFIG_DIR;
  • it showed as enabled with the report skill;
  • the installed copy's injected command printed the report.

Before npx agentdiff works for users

1. Add an npm automation token as the NPM_TOKEN repository secret. The npm name agentdiff is currently unclaimed.
2. Cut the next release (0.6.1), bumping __version__, npm/package.json and plugin.json together. That also delivers the new plugin fallbacks, because Claude Code pins plugin users to plugin.json's version.

Until then, the README's npx agentdiff line has nothing to run.

Checklist

• Exactly one logical change in this PR
• make lint passes
• uv run python -m pytest is green
• Docs updated if user-facing
• CHANGELOG.md entry added under [Unreleased] (if feat/fix)
• Conventional title: type(scope): summary