Release checklist: settings-pin bump doesn't move the installed package (version-skew produces confusing unknown-row warning)

[rz1989s]

Seen live (2026-09-03): after shipping v0.5.0/v0.5.1, a fresh pi session warned unknown display.rows id "model+ctx" and fell back to the default order.

Root cause chain (3 layers):

1. pi update --extensions updates within the semver range captured in ~/.pi/agent/npm/package.json (^0.4.9) — a 0.x minor bump (^0.5.1) is OUTSIDE that range, so update 'succeeds' while staying on 0.4.9.
2. The settings-pin bump alone (settings.json npm:@getpipher/pi-statusline@0.5.1) does NOT touch that range.
3. Running pi sessions hold settings.json in memory; their write-backs can regress a bumped pin (observed: 0.5.1 → 0.4.9 without human action).

Result: new config features (compound rows) + old package = D6 degradation fires with a message that reads like a config typo when it's really version skew.

Proposed fixes (any of):

• Release checklist/tooling: after publish, also update the ~/.pi/agent/npm/package.json range (or make pi update --extensions re-sync ranges from exact settings pins) + re-verify the pin didn't regress.
• Unknown-row warning could include the loaded package version (pi-statusline 0.4.9: unknown id …) so version skew is self-evident.

Workaround used: restore pin + edit the npm range + npm install in ~/.pi/agent/npm → 0.5.1 active, warning gone.