release: 0.7.6 (fix permission denied on global install)

The 0.7.5 tarball shipped `dist/bin/codegraph.js` without the executable
bit set, causing `zsh: permission denied: codegraph` after a fresh global
install. The build script now `chmod +x`'s the binary before packing.

Also adds CHANGELOG.md and documents the release workflow in CLAUDE.md.

CHANGELOG.md

@@ -0,0 +1,23 @@
+# Changelog
+
+All notable changes to CodeGraph are documented here. Each entry also ships as
+a [GitHub Release](https://github.com/colbymchenry/codegraph/releases) tagged
+`vX.Y.Z`, which is where most people will look.
+
+This project follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
+and adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.7.6] - 2026-05-13
+
+### Fixed
+- `codegraph` CLI failing with `zsh: permission denied: codegraph` after a fresh
+  global install. The published 0.7.5 tarball shipped `dist/bin/codegraph.js`
+  without the executable bit, so the shell refused to run it through the npm
+  symlink. The build now `chmod +x`'s the binary before packing.
+
+  Already on 0.7.5? Either upgrade to 0.7.6, or unblock yourself in place:
+  ```bash
+  chmod +x "$(npm root -g)/@colbymchenry/codegraph/dist/bin/codegraph.js"
+  ```
+
+[0.7.6]: https://github.com/colbymchenry/codegraph/releases/tag/v0.7.6

CLAUDE.md

@@ -139,6 +139,49 @@ CodeGraph provides **code context**, not product requirements. For new features,
 - Edge cases and error handling
 - Acceptance criteria
 
+## Releases
+
+Releases are published to npm **and** mirrored as GitHub Releases on the
+[Releases page](https://github.com/colbymchenry/codegraph/releases), which is
+where most users look for change history. `CHANGELOG.md` at the repo root is
+the source of truth — each GitHub Release's notes are extracted from it.
+
+### Writing changelog entries
+
+When the user asks for a changelog entry for a new version:
+
+1. Add a new `## [X.Y.Z] - YYYY-MM-DD` block at the **top** of `CHANGELOG.md`
+   (directly under the intro, above the previous version).
+2. Group changes under `### Added`, `### Changed`, `### Fixed`, `### Removed`,
+   `### Deprecated`, `### Security` — only include sections that have entries.
+3. Write entries from the **user's perspective**, not the implementation's.
+   Lead with the observable symptom or capability, then mention internals only
+   if a user needs them (e.g., to work around an existing bad install).
+4. Add the link reference at the bottom:
+   `[X.Y.Z]: https://github.com/colbymchenry/codegraph/releases/tag/vX.Y.Z`
+
+### Release commands (the user runs these)
+
+After the changelog entry is written and the version is bumped in `package.json`:
+
+```bash
+git add package.json package-lock.json CHANGELOG.md
+git commit -m "release: X.Y.Z (<one-line summary>)"
+git push
+
+npm publish
+
+git tag vX.Y.Z
+git push origin vX.Y.Z
+gh release create vX.Y.Z \
+  --title "vX.Y.Z" \
+  --notes-file <(awk '/^## \[X.Y.Z\]/,/^## \[/{ if (/^## \[/ && !/X.Y.Z/) exit; print }' CHANGELOG.md)
+```
+
+Do **not** run `npm publish`, `git tag`, `git push`, or `gh release create`
+yourself — these are publish actions that affect shared state. Write the file,
+hand the user the commands.
+
 ## Test Structure
 
 Tests are in `__tests__/` directory with files mirroring the module structure:

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@colbymchenry/codegraph",
-  "version": "0.7.2",
+  "version": "0.7.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@colbymchenry/codegraph",
-      "version": "0.7.2",
+      "version": "0.7.6",
       "license": "MIT",
       "dependencies": {
         "@clack/prompts": "^1.3.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@colbymchenry/codegraph",
-  "version": "0.7.2",
+  "version": "0.7.6",
   "description": "Supercharge Claude Code with semantic code intelligence. 94% fewer tool calls • 77% faster exploration • 100% local.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -13,7 +13,7 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsc && npm run copy-assets",
+    "build": "tsc && npm run copy-assets && node -e \"require('fs').chmodSync('dist/bin/codegraph.js', 0o755)\"",
     "preuninstall": "node dist/bin/uninstall.js",
     "copy-assets": "node -e \"const fs=require('fs');fs.mkdirSync('dist/db',{recursive:true});fs.copyFileSync('src/db/schema.sql','dist/db/schema.sql');fs.mkdirSync('dist/extraction/wasm',{recursive:true});fs.readdirSync('src/extraction/wasm').filter(f=>f.endsWith('.wasm')).forEach(f=>fs.copyFileSync('src/extraction/wasm/'+f,'dist/extraction/wasm/'+f))\"",
     "dev": "tsc --watch",