fix(release): validate staged bundle dependencies

[code-yeongyu]

Summary

• validate the staged bundleDependencies list instead of requiring every
  consumer-resolved optional dependency to be physically present in the npm
  tarball
• preserve the legacy all-runtime fallback for callers without a staged
  bundle manifest
• add focused RED→GREEN coverage for the publish-only failure
• document the issue claude-agent-sdk provider unusable on darwin-arm64: published tarball bundles only the linux-x64 Claude binary #446 publication recovery

Failure reproduced

Publish-only workflow
30466062567
stopped before npm publication:

senpi package tarball is missing vendored runtime dependencies:
@anthropic-ai/claude-agent-sdk-darwin-arm64, ...

The complete platform optional family is intentionally declared at the root
so npm can select the consumer architecture. Only the portable SDK belongs in
the universal bundle.

RED→GREEN

node --test scripts/prepare-senpi-publish-optionals.test.mjs

• RED: 0 passed, 1 failed on missing
  @anthropic-ai/claude-agent-sdk-darwin-arm64
• GREEN: 1 passed, 0 failed
• adjacent pack suite: 10 passed, 0 failed

Validation

• syntax checks and git diff --check
• npm run check
• npm run build
• CI=1 npm test
• canonical local release
• Senpi CLI smoke: 8/8

The previous v2026.7.29-2 tag remains unpublished. After this PR merges,
release recovery will use the next CalVer rather than rerunning the old tag.

---

Summary by cubic

Fixes the publish gate to validate only the staged bundleDependencies, so consumer-resolved native optionals can stay out of the tarball. Unblocks publishing for the cross-platform Claude Agent SDK setup from issue #446.

• Bug Fixes
  • assertSenpiPackedWorkspaceFiles() now checks bundleDependencies when provided, with a fallback to all runtime deps if not.
  • publish.mjs passes the staged bundleDependencies into the validator.
  • Added focused test proving @anthropic-ai/claude-agent-sdk is bundled while @anthropic-ai/claude-agent-sdk-darwin-arm64 may be excluded.
  • Updated docs and changelog.

^{Written for commit d108cc4. Summary will update on new commits.}