test: guard packed release artifacts

[ScriptedAlchemy]

Summary

• hash packages/agent-bundle/dist before and after test:packed and fail if packed fixtures mutate the publishable tree
• reject the synthetic runtime fixture marker from dist freshness and post-packed release gates
• share the byte-level tree snapshot helper between packed guards and uninstall tests

Verification

• pnpm build
• pnpm typecheck
• pnpm lint
• pnpm test:unit
• pnpm test:packed (rerun after review fixes)
• injected the fixture marker into dist/mcp-server-runtime.js; node scripts/check-dist-fresh.mjs rejected it, then passed after restoration

Owner review

Addresses the release-artifact ownership follow-up on #636 and #566. The final #636 merge already isolated the synthetic build/tarball; this PR makes that invariant executable at both packed-test and release boundaries.

Deslop

Deslop: GPT-5.6 Sol, 2 edits (removed unnecessary exception plumbing in the packed runner; aligned the freshness test name with all rejected states).

Self-review

Reviewer: Claude Fable 5.1 Thinking High (change-risk-reviewer).

First pass:

• Low: fixture marker literals could drift. Fixed by sharing the guard constant with the packed process assertion and pinning the unavoidable fixture-source literal in a unit test.
• Low: freshness comments omitted the new contaminated state. Fixed across the module and CLI contract comments.

Second pass after fixes: no blocking findings; both prior findings resolved. Residual concurrent-file-removal diagnostics and ambient fixture-environment messaging are safe-direction edge cases and do not affect release ownership; no change. The script-level digest guard is exercised in the passing direction by test:packed, while digest sensitivity has a focused unit test.

[changeset-bot]

🦋 Changeset detected

Latest commit: 170683d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
agent-bundle	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle@645

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/create-agent-bundle@645

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/rsc-markdown-stream@645

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@645

commit: 170683d

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.