fix(create): validate the local framework tarball for framework-only templates

[ScriptedAlchemy]

Summary

• Framework-only templates (minimal, cli-tool — no @agent-bundle/runtime dependency) previously skipped local tarball validation entirely, so --framework-version file:... pointing at a missing, corrupt, or misnamed tarball scaffolded a "ready" project with an unusable dependency.
• scaffold() now validates a file: framework tarball via the new assertLocalFrameworkTarball helper (reusing the existing localTarballPackageName reader) before emitting anything; non-file: specs remain untouched.

Addresses the unresolved P2 Codex finding on #217 (packages/create-agent-bundle/src/scaffold.ts:95-99).

Test plan

• pnpm test:unit packages/create-agent-bundle/tests/scaffold.test.ts packages/create-agent-bundle/tests/framework.test.ts (pass; missing/misnamed cases fail without the fix)
• pnpm typecheck (clean after runtime build)
• pnpm lint (0 errors, 0 warnings)

[changeset-bot]

🦋 Changeset detected

Latest commit: 1a7d3a5

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
create-agent-bundle	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T22:59:21.684563Z	1a7d3a5	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1a7d3a5223

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".