chore(pkg): release hygiene - dep pins, metadata, tarball, gates

[vreshch]

What

Packaging and release-hygiene pass. No src/ behavior change beyond a Node guard.

• Caret-pin runtime deps: chalk ^5.6.2, commander ^14.0.3, open ^11.0.0 (were latest). devDeps left as-is (lockfile covers them).
• package-guard test: new assertion that no runtime dependency uses the latest specifier, so this can't regress.
• package.json metadata: add author, bugs.url, types (./dist/index.d.ts), publishConfig.access: public.
• Drop sourcemaps from the published build: tsconfig.build.json overrides sourceMap: false + declarationMap: false (declarations kept).
• Friendly Node guard: top of src/cli.ts, dependency-free (no chalk) - if Node major < 22 print agentage requires Node.js >= 22 (you have v<x>) to stderr and exit 1.
• publish.yml gate: add ^chore\(release\) to the release-subject alternation (squash subjects with that prefix previously forced a manual workflow_dispatch). Escape hatch kept.
• Burned-slot guard in scripts/bump-version.js: if the computed next version is 0.1.19 (permanently burned npm slot, hard-403 on publish), skip to 0.1.20.
• Remove dead .npmignore: the files: ["dist"] allowlist wins, so .npmignore never fired and was misleading.
• Add CHANGELOG.md to the files allowlist so the tarball actually ships it (npm only auto-includes README/LICENSE).
• Fix CLAUDE.md drift: the package-guard dep-set line now lists the real frozen set (memory-core + server-memory + @modelcontextprotocol/sdk + chalk + commander + open).

Why

latest specifiers make installs non-reproducible; sourcemaps ~doubled the tarball; the missing gate prefix + burned-slot bump caused prior manual-release friction; the doc line was inaccurate.

Kept (not removed)

@anthropic-ai/sdk devDep: scripts/generate-changelog.js imports it (import Anthropic from '@anthropic-ai/sdk'), so it is genuinely used - left in place.

Verification

• npm run verify green: type-check + type-check:e2e + lint + format:check + 338 tests passing + build.
• npm pack --dry-run:
  • before (with maps): 187 files, 92 .map files
  • after (no maps): 96 files, 0 .map files (92 map files removed; +1 for CHANGELOG.md)
  • tarball contains dist/ (incl. dist/cli.js, dist/index.d.ts), README.md, LICENSE, CHANGELOG.md.
• Node guard smoke: node dist/cli.js --version -> 0.0.3 on Node 22.

[github-actions]

🎉 PR Validation ✅ PASSED

Commit: 24c6ed30096321a6de7279fd36c4c76194dc0d7d
Branch: chore/release-hygiene

Checks:

• ✅ Release guard (no version/changelog changes)
• ✅ Dependencies installed
• ✅ Type check passed
• ✅ Linting passed
• ✅ Format check passed
• ✅ Tests + coverage passed
• ✅ Build successful

Ready to merge! ✨

---

🔗 View workflow run
⏰ Generated at: 2026-07-07T22:01:03.216Z