fix: harden npm distribution release and installer

- release.yml: build static musl Linux binaries (no host glibc
  requirement), add darwin-x64, publish SHA256SUMS, allow
  workflow_dispatch for an existing tag (v0.2.3 has no binaries yet),
  and run build-only on PRs that touch the workflow or installer
- install.js: verify downloads against the release SHA256SUMS
  (IDX_BINARY_SHA256 for overrides), add a 60s request timeout, use
  stream.pipeline so truncated downloads fail, and skip the download
  inside the source checkout
- idx.js: forward SIGTERM/SIGHUP to the binary and keep the signal
  exit status
- package.json: drop the prepare script (no Rust toolchain needed to
  pack/publish)
- npm-smoke.sh: read the tarball name from npm pack, use grep over rg
- .gitignore: ignore /bin/ and *.tgz
- docs: musl targets, checksums, pnpm/bun opt-in, manual release flow

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017a5Cv5Z1NzdYKgKnTiAF4E

scripts/idx.js

@@ -16,6 +16,13 @@ if (!fs.existsSync(binaryPath)) {
 
 const child = spawn(binaryPath, process.argv.slice(2), { stdio: "inherit" });
 
+// Pass termination signals from a supervisor (kill, docker stop) to the binary.
+for (const signal of ["SIGTERM", "SIGHUP"]) {
+  process.on(signal, () => child.kill(signal));
+}
+// Ctrl+C already reaches the binary through the terminal's process group.
+process.on("SIGINT", () => {});
+
 child.once("error", (error) => {
   console.error(`idx-cli: failed to start ${binaryPath}: ${error.message}`);
   process.exit(1);
@@ -23,6 +30,7 @@ child.once("error", (error) => {
 
 child.once("exit", (code, signal) => {
   if (signal) {
+    process.removeAllListeners(signal);
     process.kill(process.pid, signal);
     return;
   }