fix: tighten runtime scaffolds and effect lint paths (#199 follow-ups)

[ScriptedAlchemy]

Summary

Addresses the three unresolved P2 Codex findings on #199:

• scaffold.ts:89 — require a runtime tarball only when the template uses it: scaffold() now inspects the selected template's checked-in manifest (package_json) and only runs validatedRuntimeSpecForFramework when the template declares @agent-bundle/runtime as workspace:*. Framework-only local-tarball scaffolds (minimal, cli-tool) work again without an adjacent runtime tarball; a drift guard still fails loudly if a manifest unexpectedly needs the runtime spec.
• framework.ts:27 — reject non-registry specs instead of mirroring them: the fallback that copied the framework spec into the @agent-bundle/runtime dependency now only accepts specs that resolve independently under each package name (semver versions/ranges/dist-tags). Generic URLs, git specs, npm: aliases, and tarball-named specs raise the existing UsageError with an updated actionable message.
• eslint-plugin-effect-boundary.ts:121 — restrict nested lint paths to actual Effect namespaces: whole-module import * as E from 'effect' bindings are now tracked separately from Effect/Runtime runner namespaces. Only direct runners (Effect.runPromise, aliased Eff.runSync, subpath star imports) and true nested runners (E.Effect.runPromise, E.Runtime.runSync) are flagged; Effect.adapter.runPromise() and E.worker.runSync() no longer block lint.

Tests

• rejects package specs that cannot resolve independently under the runtime name
• scaffolds the <template> template without a runtime tarball
• rejects aliased Effect namespaces (named and subpath star imports)
• rejects Effect and Runtime runners reached through a whole-module namespace
• ignores runner-shaped methods below non-Effect namespaces

Gates: scoped rstest (lint-plugin + framework + scaffold), pnpm typecheck, repo-wide pnpm lint under the modified plugin — all green.

[changeset-bot]

🦋 Changeset detected

Latest commit: bd5d769

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
create-agent-bundle	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T21:40:44.988301Z	bd5d769	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bd5d76936a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".