P0: Publish the provider SDKs to PyPI and the Go module registry

[macanderson]

Problem

PR #43 shipped conformant provider SDKs in sdk/typescript, sdk/python, and
sdk/go — each passes the full conformance suite in CI. But they are only usable
from a checkout: npm install @contextgraph/sdk, pip install contextgraph-sdk,
and go get .../sdk/go/contextgraph all dead-end today, exactly like "build a
provider today" did for the crates before #16.

This is the SDK analogue of #16 (publish the crates to crates.io): the code is
done and green, the distribution is the missing half.

Deliverables

• npm — publish @contextgraph/sdk (public scoped package). Settle the scope
  (@contextgraph vs @oxagen), confirm files/.npmignore hygiene (currently
  files: ["dist/src"]), then npm publish --access public (with provenance if
  desired).
• PyPI — publish contextgraph-sdk. python -m build (sdist + wheel),
  twine upload; confirm the name is free.
• Go — Go modules publish by tag, not a registry. The submodule path is
  .../sdk/go, so the tag is sdk/go/v0.1.0, after which
  go get github.com/macanderson/context-graph-protocol/sdk/go/contextgraph@v0.1.0
  resolves.
• A PUBLISHING.md-style checklist for the SDKs (mirror the crates one) and
  CHANGELOG wiring for SDK versions.
• Optional: a tag → publish release workflow, once the first manual publish is done.

Acceptance

• npm install @contextgraph/sdk, pip install contextgraph-sdk, and
  go get .../sdk/go/contextgraph@<tag> each work from a clean environment and
  can build/run the example provider.
• Versions align (0.1.0) and are recorded in the CHANGELOG.

Notes

The first publish of each is a human action (registry auth/tokens), like #16 —
this issue is the checklist that makes that first publish boring. Blocks the
"install and build a provider in five minutes" story #17 exists for.

[macanderson]

Re-verified 2026-07-26 against origin/main @ 1ee9b1c. Retitled — one of the three legs is already done, under a different name than the body assumes.

What landed: the npm leg. @contextgraphprotocol/typescript-sdk 0.1.0 is published, and was published roughly an hour before this issue was filed. PR #46 renamed the in-repo package to match, which also settles the scope/naming question the body opens: the answer is @contextgraphprotocol/typescript-sdk, not @contextgraph/sdk. That question can be dropped rather than decided.

What survives: PyPI and the Go module registry. The Go leg overlaps #30 — a sdk/go module is only fetchable once there is an addressable tag, so #30 is a hard prerequisite, not a nicety. Two READMEs still advertise install commands that do not resolve, and will keep misleading readers until the names are corrected.

Recommended scope: publish PyPI and the Go module; correct the package name throughout the body and in both READMEs; write down the publishing checklist so the next release is not archaeology. Drop the resolved naming question.