chore: sync public mirror from internal

[haasonsaas]

Problem

The public Deixic Code tree is still at 0.10.90 while the merged Mono source is at 0.10.91. The scheduled sync-public-release-mirror job for that merge is queued without a runner, leaving the reviewed public source and its session and disconnected-profile documentation behind.

Summary

• Project the sanitized public tree from dx-corp/mono#9670 at 6878323651fdb771b8cbf76b08597b930938ce36 with Mono's dedicated Code projection.
• Update 80 mirrored paths and add the deterministic .repository-projection.json receipt; delete no files.
• Preserve public-owned workflows, actionlint settings, package validators, and the two public-only commits already on dx-corp/code main.

Internal source SHA: 6878323651fdb771b8cbf76b08597b930938ce36.

Source-of-truth status

The committed Mono source and its existing sanitizer produced the same reviewed Code payload. The dedicated project.mjs apply and verify commands report content digest 325d36d4b27c054e6edd55e71460299cdf56f8dc3ed887ae92ac326b531e60bc, 80 copy/update paths, and zero deletions. The public version guard accepts 0.10.91 over 0.10.90. The source's official post-merge Maestro Clippy and full workspace test receipts passed on a clean tree identical to the merged source tree.

Public-only commits since last generated sync

• c50b5f57 — finish dx-corp/code ownership migration (fix(release): finish dx-corp/code ownership migration #1150)
• 4c484fec — remove obsolete browser packaging (fix(release): remove obsolete browser packaging #1159)

Both remain in this branch's base. No destination-owned workflow or package-validation path changed.

Validation

• node scripts/projections/project.mjs apply and verify for deixic-code — passed against this checkout.
• node products/maestro/scripts/check-prepared-public-mirror-tree.mjs --target <checkout> — passed.
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.9 -shellcheck= -pyflakes= — passed on the prepared public tree.
• node --test scripts/version.test.mjs — 6 passed.
• node --test .github/workflows/check-release-workflow-contract.test.mjs — 84 passed; node .github/workflows/check-release-workflow-contract.mjs passed.
• Prepared public mirror guardrails — shipped script syntax/reference validation, hosted Computer delegation tests (5 passed), locked Cargo metadata, and Rust-only source/docs checks all passed.
• node --test scripts/tag-release-contract.test.mjs — 3 passed; npm run check:workspace-contract and git diff --check passed.
• The optional npm run check:doc-paths reports 15 dangling references, identically reproduced on untouched public main 4c484fec; none are in changed documentation. It is a pre-existing finding, not a passing check.

Full public Cargo build/test was not run on the local macOS checkout because its Homebrew rustc is broken and only 13 GiB was free. Destination CI must validate the prepared public tree before merge; this PR does not publish an npm package or deploy a runtime.

Test Plan

Inspect exact-head destination checks, resolve substantive review findings, then merge normally only after required contexts pass. This PR mirrors approved source; it does not claim a release.

Staged Rollout

No runtime or registry rollout occurs. The public repository receives the reviewed source projection; package publication remains a separate release action.

No-Issue: This is the scheduled source mirror of the merged Mono repository-family PR.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​yaml@​2.9.0 ⏵ 2.9.1	+1

View full report