fix: prevent publishing unresolved workspace imports

[thymikee]

Summary

• prevent private @agent-device/* workspace imports from escaping the npm bundle
• fail prepack immediately when the built JS or declarations retain a private workspace import
• exercise agent-device devices --json from the globally installed tarball in package CI
• migrate the tsdown dependency rule to the current deps.alwaysBundle API

This fixes the published 0.20.4 regression where npx agent-device devices failed with an unresolved @agent-device/ad-script import. The build had warned about unresolved workspace packages but still emitted a publishable tarball.

Validation

• reproduced the failure with npx --yes agent-device@0.20.4 devices
• proved the new bundle gate fails against output built with missing workspace links
• built and globally installed a local tarball in an isolated prefix; agent-device devices --json succeeds
• pnpm check:unit — 597 files / 5261 tests plus smoke passed
• tooling, build, bundle-integrity, and Fallow gates passed
• an unrelated help-conformance benchmark timed out once during a second full pnpm check under load and passed in isolation in 340 ms

Docs

No docs or skills changes: this restores the existing packaged CLI contract and adds release-integrity enforcement; command behavior is unchanged.

[github-actions]

Size Report

Metric	Base	Current	Diff
JS raw	1.96 MB	1.96 MB	0 B
JS gzip	626.6 kB	626.6 kB	0 B
npm tarball	746.3 kB	746.3 kB	+31 B
npm unpacked	2.61 MB	2.61 MB	+173 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	31.2 ms	31.3 ms	+0.1 ms
CLI --help	71.7 ms	72.3 ms	+0.6 ms

Top changed chunks: no changes in the largest emitted chunks.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-08-03 20:34 UTC