refactor(publish): parallel platform jobs with fresh OIDC tokens per job

- Split monolithic publish into build + parallel publish-platform + publish-main + release jobs
- Each platform package gets its own OIDC token (fixes token expiration during large binary uploads)
- Add --prepare-only flag to publish.ts for build step version sync
- Matrix strategy: 7 parallel platform jobs
- publish-main waits for all platforms before publishing main package

script/publish.ts

@@ -8,6 +8,7 @@ const PACKAGE_NAME = "oh-my-opencode"
 const bump = process.env.BUMP as "major" | "minor" | "patch" | undefined
 const versionOverride = process.env.VERSION
 const republishMode = process.env.REPUBLISH === "true"
+const prepareOnly = process.argv.includes("--prepare-only")
 
 const PLATFORM_PACKAGES = [
   "darwin-arm64",
@@ -390,6 +391,13 @@ async function main() {
   const newVersion = versionOverride || (bump ? bumpVersion(previous, bump) : bumpVersion(previous, "patch"))
   console.log(`New version: ${newVersion}\n`)
 
+  if (prepareOnly) {
+    console.log("=== Prepare-only mode: updating versions ===")
+    await updateAllPackageVersions(newVersion)
+    console.log(`\n=== Versions updated to ${newVersion} ===`)
+    return
+  }
+
   if (await checkVersionExists(newVersion)) {
     if (republishMode) {
       console.log(`Version ${newVersion} exists on npm. REPUBLISH mode: checking for missing platform packages...`)