fix: consolidate version SoT + add pre-commit lockstep guard (AL-25, closes AL-29)

[Roo4L]

Summary

Two-commit PR addressing the version-string sprawl that AL-25 (older, top-level Task) and AL-29 (newer, sub-task under AL-18) both filed against. AL-29 closes as duplicate of AL-25. Combined scope:

1. Consolidate the literal version string into a single source-of-truth at plugin/cli/package.json::version (was AL-29's scope).
2. Backstop the consolidation with a pre-commit guard that rejects drift between package.json and catalog.json at commit time (was AL-25's exclusive carve-out).

Commits

fix(precommit): lockstep guard for package.json/catalog.json version (AL-25) — 93dd714

• New scripts/check-version-lockstep.sh (pure bash + sed; no jq dependency on contributor laptops).
• Wired into .pre-commit-config.yaml as a local hook scoped to ^(plugin/cli/package\.json|plugin/catalog/catalog\.json)$.
• Self-tested: happy path → exit 0; injected drift (catalog 0.3.2 → 0.3.3) → exit 1 with clear diagnostic; restored → exit 0.
• Shifts the scripts/build-release.sh three-way version-lock gate from release-time to commit-time so the divergence never reaches master.

fix(version): consolidate version SoT to plugin/cli/package.json (AL-29) — d04bebb

Site	Before	After
plugin/bin/agentlinux-install	hardcoded constant	sed-extract from $BIN_DIR/../cli/package.json (regex-validated)
plugin/cli/src/index.ts	.version("0.3.2", ...)	import { VERSION } from "./version.js"
plugin/cli/src/catalog/loader.ts	?? "0.3.2" default	?? VERSION from new module
plugin/cli/src/catalog/schema.ts	?? "0.3.2" default	same
plugin/provisioner/10-agent-user.sh	"v0.3.0" in welcome message	dropped (advisory string, not behavioral)
tests/bats/10-installer.bats	${AGENTLINUX_VERSION:-0.3.2} fallback	jq-extract from package.json
tests/bats/40-registry-cli.bats	5 sites with hardcoded "0.3.2"	$PKG_VERSION variable derived once at file scope
tests/bats/50-agents.bats	CATALOG=/opt/agentlinux/catalog/0.3.2/...	CATALOG=/opt/agentlinux/catalog/${PKG_VERSION}/...
tests/bats/51-agt02-release-gate.bats	same	same

New module plugin/cli/src/version.ts walks up from import.meta.url looking for package.json — same pattern catalog/schema.ts already uses for schema.json. Resolves correctly in both dist/ (production) and dist-test/src/catalog/ (test build) layouts in one resolver.

Engines floor bumped from >=20 to >=22 in the same file: every CI workflow already pins setup-node@22 and the provisioner installs Node 22 LTS, so the declared minimum was ahead of reality. With the floor at 22, future TS code can rely on Node 22 features without a peer-dep warning.

Verification

• corepack pnpm test → 112/112 unit tests pass against the dist-test/ layout (the new walk-up resolver works there too).
• pre-commit run check-version-lockstep --all-files → Passed.
• Bash entrypoint --version flag prints the dynamically-extracted version when invoked from a checkout.

Out of scope (deliberately, to keep the PR landable)

• Removing catalog.json::version entirely (would need schema change + cascading updates; the new lockstep hook is the practical guard).
• TS unit-test fixtures (plugin/cli/test/fixtures/*.json) — they're self-contained test data, not version-aware, and were never the source of drift.

Test plan

• gate-1-precommit (the new lockstep hook fires on package.json's engines change in commit 2 and Passes — already verified locally)
• gate-2-docker × {22.04, 24.04, 26.04} (every bats file now reads PKG_VERSION via jq; the bind-mounted source tree is established before bats fires per tests/docker/run.sh:150)
• gate-3-qemu × {22.04, 24.04}
• After merge: bump package.json to 0.3.3 in a follow-up commit, confirm agentlinux --version reports 0.3.3, the staged catalog appears at /opt/agentlinux/catalog/0.3.3/, the bats suite passes against that path without editing any other file. This is the AL-25 acceptance criterion.

Refs: AL-25 (primary), AL-29 (will close as duplicate of AL-25), AL-30, AL-31