ci: add CLI PR preview workflow and pin pkg-pr-new

Author: kdcokenny

.github/workflows/pr-preview-cli.yml

@@ -0,0 +1,47 @@
+name: PR Preview (CLI)
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths:
+      - "packages/cli/**"
+      - "package.json"
+      - "bun.lock"
+      - ".github/workflows/pr-preview-cli.yml"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  publish-cli-preview:
+    name: Publish CLI preview package
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: package.json
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build CLI package
+        run: bun run build
+        working-directory: packages/cli
+
+      # Use repo-locked pkg-pr-new from devDependencies.
+      - name: Publish PR preview package
+        run: bunx --bun --no-install pkg-pr-new publish --bun --bin --packageManager=npm,pnpm,bun ./packages/cli
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}