fix(create): pair compiler and runtime release versions

[ScriptedAlchemy]

Summary

• record the exact agent-bundle / @agent-bundle/runtime release pair in the packed scaffolder manifest
• preserve same-SHA pkg.pr.new pairing while rejecting incompatible registry and local-tarball selections
• prove an installed scaffolder can use independently versioned real tarballs and run a built artifact after source deletion
• document registry and preview override pairing in English and Chinese

Fixes #737.

Pairing rule

Preview specs derive both package URLs from the same commit SHA. Registry releases use the exact optional-peer pair rewritten into the packed create-agent-bundle manifest by pnpm pack; local versioned compiler tarballs use that recorded runtime version for the sibling filename and validate both package manifests. A suffix-less local pair (agent-bundle.tgz / agent-bundle-runtime.tgz) remains name-paired without release metadata.

Local gate

Current branch contains origin/main at 2dffc463d7.

• pnpm build && pnpm typecheck && pnpm lint && pnpm test:unit — PASS (303 files; 4,475 passed, 6 skipped)
• pnpm test:packed:release — PASS (16 files; 45 passed, 1 skipped), including installed no-flag registry pairing, actual independently versioned compiler/runtime tarballs, clear incompatible runtime rejection, and deleted-source artifact execution
• pnpm docs:site:build — PASS (0 locale drift failures; 0 broken links across 29,989 anchors)
• pnpm lint:release — PASS (all package entry checks and declaration imports clean)
• pnpm changeset status --since=origin/main — PASS (create-agent-bundle: patch)

Deslop

Deslop: GPT-5.6 Sol, 5 edits. Corrected stale comments, moved the tarball-path contract beside its owner, flattened manifest-pair extraction, and removed stale packed-test wording without changing behavior.

Self-review

Reviewer: Claude Fable 5.1 Thinking High (change-risk-reviewer), three passes against origin/main.

• Initial findings: preview peer rewrites were incorrectly treated as registry pairing metadata; the installed no-flag registry path lacked packed coverage; the npm-name caveat and preview-peer docs needed restoration; suffix-less local pairing and a live-version assertion needed tightening.
• Disposition: preview manifests now remain SHA-paired, the installed packed no-flag path is covered, ambiguous versioned overrides fail with actionable recovery, the registry-name caveat and en/zh preview rules are documented, suffix-less local pairs remain supported, and the brittle assertion was removed.
• Final review: no remaining code, test, docs, or changeset merge risks.

[changeset-bot]

🦋 Changeset detected

Latest commit: f33da83

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
create-agent-bundle	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T08:10:43.141825Z	f33da83	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.