feat(cli): ship amy on macOS + Linux via GitHub Release

Adds a new build-cli matrix to create-release.yml so every tag push also
produces self-contained amy binaries:

  - amy-<ver>-macos-x64.tar.gz     (macos-13 runner)
  - amy-<ver>-macos-arm64.tar.gz   (macos-14 runner)
  - amy-<ver>-linux-x64.tar.gz     (ubuntu-latest)
  - amy-<ver>-linux-x64.deb        (ubuntu-latest)
  - amy-<ver>-linux-x64.rpm        (ubuntu-latest)

Each tarball is a flat tree (bin/amy + lib/*.jar + runtime/) with a
jlink'd JDK 21 embedded — no system Java required on the user machine.
The .deb / .rpm install the same tree under /opt/amy/.

Windows is intentionally deferred until cli/ is validated on Windows
(data-dir path handling, file locking on groups/<gid>.mls, identity.json
line endings).

Two follow-ups flagged in comments:

  - :commons leaks Compose + Skiko (~40 MB) as transitive deps to :cli.
    Tarball lands at ~98 MB instead of the plan's <80 MB target. Size
    budget in the workflow is set to 200 MB until :commons is split into
    core + ui modules.
  - .deb/.rpm install to /opt/amy/bin/amy with no /usr/local/bin symlink.
    Users must add to PATH or symlink manually after install.

Wire-up:
  - cli/build.gradle.kts gains jlinkRuntime + amyImage (Sync task that
    combines installDist output with the jlink runtime + a shell
    launcher) + jpackageDeb + jpackageRpm.
  - scripts/asset-name.sh gains cli_asset_name() + collect_cli_assets()
    alongside the existing desktop collector, preserving the
    <product>-<version>-<family>-<arch>.<ext> naming contract.

See cli/plans/2026-04-21-cli-distribution.md for the overall plan.

https://claude.ai/code/session_01Tbh6F7TtEeceb4K3stcUWp

scripts/asset-name.sh

@@ -1,7 +1,10 @@
 #!/usr/bin/env bash
-# Single source of truth for Amethyst Desktop release asset naming.
+# Single source of truth for Amethyst release asset naming.
+#
+# Two product lines share this contract:
+#   amethyst-desktop-<version>-<family>-<arch>.<ext>   (Compose Desktop app)
+#   amy-<version>-<family>-<arch>.<ext>                (Amy CLI — cli/ module)
 #
-# Contract: amethyst-desktop-<version>-<family>-<arch>.<ext>
 #   <version> = tag stripped of leading 'v' (e.g. "1.08.0")
 #   <family>  = macos | windows | linux
 #   <arch>    = x64 | arm64
@@ -12,7 +15,8 @@
 #
 # Usage:
 #   source scripts/asset-name.sh
-#   collect_assets <family> <arch> <version> <dest_dir>
+#   collect_assets     <family> <arch> <version> <dest_dir>   # desktop
+#   collect_cli_assets <family> <arch> <version> <dest_dir>   # amy CLI
 #
 # Expected examples:
 #   amethyst-desktop-1.08.0-macos-x64.dmg
@@ -23,6 +27,11 @@
 #   amethyst-desktop-1.08.0-linux-x64.rpm
 #   amethyst-desktop-1.08.0-linux-x64.AppImage
 #   amethyst-desktop-1.08.0-linux-x64.tar.gz
+#   amy-1.08.0-macos-arm64.tar.gz
+#   amy-1.08.0-macos-x64.tar.gz
+#   amy-1.08.0-linux-x64.tar.gz
+#   amy-1.08.0-linux-x64.deb
+#   amy-1.08.0-linux-x64.rpm
 
 set -euo pipefail
 
@@ -33,6 +42,13 @@ asset_name() {
     printf 'amethyst-desktop-%s-%s-%s.%s' "$version" "$family" "$arch" "$ext"
 }
 
+# CLI variant of asset_name — same shape, different product prefix.
+# Usage: cli_asset_name <family> <arch> <version> <ext>
+cli_asset_name() {
+    local family="$1" arch="$2" version="$3" ext="$4"
+    printf 'amy-%s-%s-%s.%s' "$version" "$family" "$arch" "$ext"
+}
+
 # Copy + rename build outputs into <dest_dir> using the canonical naming scheme.
 # Usage: collect_assets <family> <arch> <version> <dest_dir>
 # Expects build outputs under desktopApp/build/... (Compose binaries + custom tasks + portable archives).
@@ -66,3 +82,48 @@ collect_assets() {
     done
     shopt -u nullglob
 }
+
+# Copy + rename amy CLI build outputs into <dest_dir> using the canonical
+# amy-<version>-<family>-<arch>.<ext> scheme.
+#
+# Expected inputs:
+#   cli/build/amy-image/amy/    flat app-image built by :cli:amyImage
+#                               (bin/amy + lib/*.jar + runtime/)
+#   cli/build/jpackage/*.deb    from :cli:jpackageDeb (Linux only)
+#   cli/build/jpackage/*.rpm    from :cli:jpackageRpm (Linux only)
+#
+# Usage: collect_cli_assets <family> <arch> <version> <dest_dir>
+collect_cli_assets() {
+    local family="$1" arch="$2" version="$3" dest="$4"
+    mkdir -p "$dest"
+    local abs_dest
+    abs_dest="$(cd "$dest" && pwd)"
+    shopt -s nullglob
+
+    # 1. Tar the flat app-image into amy-<version>-<family>-<arch>.tar.gz.
+    #    This is the portable-across-OS asset — macOS runners produce only
+    #    this one.
+    local app_image="cli/build/amy-image/amy"
+    if [ -d "$app_image" ]; then
+        local tarball="$abs_dest/$(cli_asset_name "$family" "$arch" "$version" tar.gz)"
+        ( cd "$(dirname "$app_image")" && tar czf "$tarball" "$(basename "$app_image")" )
+        echo "Collected: $tarball"
+    fi
+
+    # 2. Linux native installers (.deb, .rpm). jpackage writes them directly
+    #    to cli/build/jpackage/ with its own naming, so we re-copy under the
+    #    canonical scheme.
+    local src base ext dst
+    for src in \
+        cli/build/jpackage/*.deb \
+        cli/build/jpackage/*.rpm \
+    ; do
+        [ -f "$src" ] || continue
+        base="$(basename "$src")"
+        ext="${base##*.}"
+        dst="$abs_dest/$(cli_asset_name "$family" "$arch" "$version" "$ext")"
+        cp "$src" "$dst"
+        echo "Collected: $dst"
+    done
+    shopt -u nullglob
+}