fix(T12011): publish pipeline stages studio-dist; tarball gate asserts files[] entries

[kryptobaseddev]

Summary

• Root cause: packages/cleo/package.json declares studio-dist in files[] but the release CI pipeline never built @cleocode/studio before pnpm publish. npm silently omits files[] entries that do not exist at publish time — so every @cleocode/cleo tarball has shipped without studio-dist since v2026.6.13. cleo web boots the gateway but /studio returns E_STUDIO_BUNDLE_ABSENT from every npm install.
• Pipeline fix (.github/workflows/release.yml): new "Build Studio bundle and stage into packages/cleo" step runs after pnpm run build, builds @cleocode/brain + @cleocode/studio, then invokes packages/cleo/scripts/copy-studio-dist.mjs (the T11979 staging mechanism). Adds a guard that fails the step if studio-dist/client/ is absent after staging.
• Tarball gate (scripts/assert-cleo-tarball.mjs): new loud gate run by a CI step before publish — asserts every files[] entry exists on disk with ::error:: annotations + exit 1 on any missing entry; also asserts studio-dist/client/_app/ is present. A silently-thinner tarball can never ship again.
• Studio dep fixes (packages/studio/package.json): add @cleocode/cant, @cleocode/caamp, jsonc-parser as explicit workspace deps so pnpm links them into studio's node_modules for the SvelteKit adapter-node SSR server transitive resolution.
• DHQ-098 appended to docs/plan/dogfood-harness-question-ledger.md (status: FIXED).

Local pack-listing proof

After CLEO_STUDIO_BUILD_DIR=/tmp/studio-build-T12011 node packages/cleo/scripts/copy-studio-dist.mjs:

npm notice 52B studio-dist/client/_app/immutable/assets/app.css
npm notice 55B studio-dist/client/_app/immutable/chunks/start.js
npm notice 39B studio-dist/client/_app/version.json
npm notice 27B studio-dist/index.js

studio-dist files appear in the tarball listing. Before the fix, npm pack --dry-run showed zero studio-dist entries.

Gate fail-mode proof

$ mv packages/cleo/studio-dist packages/cleo/studio-dist-backup
$ node scripts/assert-cleo-tarball.mjs
::error::assert-cleo-tarball: files[] entry "studio-dist" is MISSING on disk ...
::error::assert-cleo-tarball: studio-dist/ directory is MISSING at ...
[assert-cleo-tarball] FAILED — see errors above.
Exit code: 1

Gate pass-mode proof

$ node scripts/assert-cleo-tarball.mjs
[assert-cleo-tarball] Checking packages/cleo/package.json files[] entries...
  OK  dist
  OK  completions
  OK  bin
  OK  scripts
  OK  templates
  OK  assets
  OK  studio-dist
[assert-cleo-tarball] Checking studio-dist layout...
  OK  studio-dist/client/ (SvelteKit static assets present)
  OK  studio-dist/client/_app/ (immutable asset tree present)
[assert-cleo-tarball] All assertions passed — @cleocode/cleo tarball is complete.
Exit code: 0

Template parity lint (Gate 7)

Gate 7 (scripts/lint-deployed-template-parity.mjs) covers only release-prepare.yml — release.yml has no template. Gate 7 is unaffected by this PR.

Post-publish proof

Full post-publish proof (cleo web serving a non-blank Studio from a fresh npm install -g @cleocode/cleo) lands with the next release after the Studio build resolves remaining runtime dep-chain issues. The gate in this PR ensures the tarball never ships without studio-dist again.

Staging mechanism

packages/cleo/scripts/copy-studio-dist.mjs (line 55: await cp(srcDir, destDir, { recursive: true })) is the T11979 staging mechanism invoked by the postbuild lifecycle hook. The CI step now invokes it explicitly after building Studio.

🤖 Generated with Claude Code