fix(docker)(agentic_hosting#26): normalise sphere-sdk version before file: install

[vrogojin]

Summary

Fixes the Invalid Version: 0.0.a1 failure that blocked the v0.2 docker-publish.yml build (run 27281190676).

Root cause

Stage-1 of the trader image build uses npm ci (lenient — installs from lockfile, doesn't strict-validate the file: dep's own package.json). Stage-2 uses npm install (strict — re-resolves the file: dep when the path changes via sed), which validates every encountered version against semver and refuses anything malformed.

Upstream sphere-sdk main currently carries "version": "0.0.a1" (commit b8b526d, "chore(release): 0.0.a1") — a1 is not a valid semver prerelease tag (must be [0-9A-Za-z-]+; the form 0.0.a1 parses as MAJOR.MINOR.PATCH where a1 isn't a number). All four rotations this PR is meant to pick up (#456/#457/#464/#447) landed after that bad version commit, so we can't sidestep by pinning earlier.

Fix

Insert npm pkg set version=0.0.0-dev --prefix sphere-sdk between the file: path rewrite and npm install:

RUN sed -i 's|"file:../sphere-sdk"|"file:./sphere-sdk"|' package.json \\
 && npm pkg set version=0.0.0-dev --prefix sphere-sdk \\
 && npm install --omit=dev --ignore-scripts

The version field on a file: dep is informational only — npm resolves by path, not by version constraint — so this rewrite has zero functional effect beyond letting the install proceed. Robust against any future invalid-semver drift upstream.

Follow-up

A separate upstream PR to sphere-sdk normalising the version field is appropriate (so other downstreams that depend on file:../sphere-sdk aren't broken). Tracked as task #37 in this session; will land asynchronously and not in this PR's critical path.

Test plan

• CI (ci.yml) passes on this branch
• After merge: delete the failed v0.2 release + tag, re-cut v0.2 release pointing at the new master HEAD
• After release tag: docker-publish.yml builds + pushes ghcr.io/vrogojin/agentic-hosting/trader:v0.2
• Downstream: vrogojin/agentic_hosting#27 can merge once image is live

Related

• vrogojin/agentic_hosting#26 (the rebuild this unblocks)
• chore(ci)(agentic_hosting#26): bump SPHERE_SDK_SHA to main tip 550114c (v0.2 trader image) #23 (the SDK SHA bump that triggered the build)
• feat(trader)(sphere-sdk#474): roundtrip soak + demo playbook + spec drift audit + #473 investigation unicity-sphere/sphere-sdk#475 (the soak that consumes v0.2)