feat: make the npm root the canonical distribution

[ScriptedAlchemy]

Closes #555. Supersedes closed #639.

Summary

• copy the validated composite artifact into the npm root and point generated package bins at the manifest-owned executable; no second CLI compilation
• persist package-only compile evidence, validate supported lifecycle paths, and reject missing lifecycle assets before publication
• advance the manifest contract to v3 for the canonical npm-root guarantee; make install.mjs manifest-first while retaining manifest-less fallback discovery
• preserve authored AGENTS.md; strip authored files/.npmignore policy from the generated root so selected hidden host files cannot silently disappear

Acceptance

• packed-web-command.test.ts: installs with lifecycle scripts enabled, deletes source, resolves the executable declared by the installed package.json bin, and proves operation/web behavior plus executable bytes match the artifact
• packed-host-install-proof.test.ts: compares every manifest file byte/hash/mode in the tarball and installed root, checks projection/executable/install references, selected hidden roots, and forbidden fallback manifests, then exercises host install/doctor/uninstall from the reconstructed packed artifact
• prepack.test.ts: packs dist, installs it, deletes source, and runs the installed manifest-driven install.mjs
• host-install-proof.test.ts: proves the standalone installer file order matches core manifestInventory and reindexes same-version rebuild markers

mcp-app-real trace disposition

Downloaded the failed Node 24 integration-2 artifact from run 33985868555/job 101359182105. The first case consumed 36.7s and reached its assertion with only 1.939s remaining; the second mcp-app-real case and separate real web acceptance passed in the same shard. This was shard-load timing, not a syntax fixture or npm-root regression. No timeout was raised.

Local merge gate

Final branch includes origin/main d94223a663; all commands passed locally on 543928c46f:

• PASS — pnpm build && pnpm typecheck && pnpm lint && pnpm test:unit
• PASS — pnpm test:packed (14 files, 39 passed, 1 skipped)
• PASS — pnpm docs:site:build

Deslop

Deslop: GPT-5.6 Sol, 2 edits (removed the obsolete installer path and corrected manifest-selected MCP output handling).

Self-review

Reviewer: Claude Fable 5.1 Thinking High.

• Round 1: fixed stale installed-installer acceptance, manifest-only standalone copy set, lost AB6005 residual-import coverage, and the authored npm policy proof; documented the mandated v3 compatibility consequence.
• Round 2: fixed portable marker reindexing and aligned standalone/core manifest file ordering; rejected an inapplicable portable-as-Cursor Doctor comparison and added a direct core inventory-order proof instead.
• Final review: no concrete merge risks found.

[changeset-bot]

🦋 Changeset detected

Latest commit: 543928c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
agent-bundle	Minor
create-agent-bundle	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle@656

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/create-agent-bundle@656

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/rsc-markdown-stream@656

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@656

commit: 543928c

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.