revert: roll back to v2.137.0 for stable k8s release

[viktormarinho]

Summary

• Reverts all 13 commits from 2.138.x series (158a038..2c4dde3) to match commit 7ed212ac (v2.137.0)
• Removes local-mode feature, studio package, bootstrap/dev scripts, and related auth changes introduced in 2.138.x
• Applied as a forward diff (not force push) so history is preserved

Why

Need a stable k8s release based on the 2.137.0 baseline.

Test plan

• Verify tree matches 7ed212ac: git diff 7ed212ac HEAD should be empty after merge
• Build passes: bun run check && bun run lint && bun test
• k8s deployment succeeds

🤖 Generated with Claude Code

---

Summary by cubic

Rolls back the codebase to v2.137.0 to ship a stable Kubernetes release. Removes all 2.138.x features (local mode, Studio wrapper, bootstrap/dev scripts) and restores v2.137.0 behavior and packaging.

• Migration
  • Start with npx @decocms/mesh (replace bunx decocms); the decocms wrapper package and its publish workflow were removed.
  • Data defaults to ./data (file:./data/mesh.db and ./data/assets); MESH_HOME is no longer used. Set DATABASE_URL explicitly in k8s.
  • Local mode is removed: no auto-login or seeding. Remove MESH_LOCAL_MODE from CI/e2e and environments.
  • OAuth now enforces same-origin postMessage; setOAuthRedirectOrigin and internalUrl are removed. Ensure callbacks use the app’s exact origin.
  • Dev asset/MCP test routes only run when NODE_ENV !== production.
  • Release naming/docs switched to @decocms/mesh; versions revert to v2.137.0 (runtime to 1.2.10).

^{Written for commit 0053197. Summary will update on new commits.}

[github-actions]

🧪 Benchmark

Should we run the Virtual MCP strategy benchmark for this PR?

React with 👍 to run the benchmark.

Reaction	Action
👍	Run quick benchmark (10 & 128 tools)

Benchmark will run on the next push after you react.

[github-actions]

Release Options

Should a new version be published when this PR is merged?

React with an emoji to vote on the release type:

Reaction	Type	Next Version
👍	Prerelease	2.138.5-alpha.1
🎉	Patch	2.138.5
❤️	Minor	2.139.0
🚀	Major	3.0.0

Current version: 2.138.4

Deployment

• Deploy to production (triggers ArgoCD sync after Docker image is published)

[cubic-dev-ai]

No issues found across 54 files