docs: add release workflow and document release process

- Add GitHub Release creation to publish workflow (auto-generated notes)
- Document release process in CLAUDE.md and README.md
- Bump contents permission to write for gh release create

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: rrodrigu3z

.github/workflows/publish.yml

@@ -9,7 +9,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write
       id-token: write
     steps:
       - uses: actions/checkout@v4
@@ -30,3 +30,8 @@ jobs:
       - run: pnpm publish --no-git-checks
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Create GitHub Release
+        run: gh release create "${{ github.ref_name }}" --generate-notes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

CLAUDE.md

@@ -50,6 +50,15 @@ pnpm generate         # Regenerate TS from .proto (needs protoc)
 - Integration tests gated behind `OPENSHELL_TEST=1` env var
 - Generated code excluded from lint and format
 
+## Releasing
+
+```bash
+npm version patch   # or minor/major — bumps package.json, creates v* tag
+git push --follow-tags  # pushes tag → CI publishes to npm + creates GitHub Release
+```
+
+CI handles everything after the tag push: build, test, npm publish, GitHub Release with auto-generated notes.
+
 ## Commit Conventions
 
 Format: `type(scope): description`

README.md

@@ -165,6 +165,13 @@ For access to all generated protobuf types (security policies, providers, SSH se
 import { SandboxPolicy, NetworkPolicyRule } from "openshell-node/generated";
 ```
 
+## Releasing
+
+```bash
+npm version patch   # or minor/major — bumps package.json, creates git tag
+git push --follow-tags  # tag push triggers CI → npm publish + GitHub Release
+```
+
 ## Contributing
 
 See [CONTRIBUTING.md](./CONTRIBUTING.md) for development setup and guidelines.