fix: restore D1 query-count collection

[ascorbic]

What does this PR do?

Restores the real-D1 query-count run after the bundled Sigstore verifier introduced Node-only code into Core's Worker path. Core now imports a dedicated runtime-neutral bundle-validation entry, while the query harness fails closed on non-2xx responses, missing or duplicate route-phase markers, truncated query logs, and empty measurements.

Supports #1908.

Type of change

• Bug fix
• Feature (requires maintainer-approved Discussion)
• Refactor (no behavior change)
• Translation
• Documentation
• Performance improvement
• Tests
• Chore (dependencies, CI, tooling)

Checklist

• I have read CONTRIBUTING.md
• pnpm typecheck passes
• pnpm lint passes
• pnpm test passes (or targeted tests for my change)
• pnpm format has been run
• I have added/updated tests for my changes (if applicable)
• User-visible strings in the admin UI are wrapped for translation (not applicable: no admin UI strings)
• I have added a changeset (covered by the existing canonical bundle verification changeset on the integration branch)
• New features link to an approved Discussion: not applicable, bug fix

AI-generated code disclosure

• This PR includes AI-generated code, model/tool: OpenCode with GPT-5.6-sol

Screenshots / test output

• pnpm build
• pnpm typecheck
• pnpm lint:json
• pnpm test:query-counts (5 tests)
• Registry verification: 93 Node tests and 35 workerd tests
• Core marketplace client: 23 tests
• Fresh real-D1 fixture build: all 20 route phases returned 200 and passed marker/event integrity guards; compare mode then failed only against the intentionally empty D1 baseline, which the Query Counts Apply workflow will regenerate

---

Try this PR

Open a fresh playground →

A full working EmDash site, deployed from this branch. Each visit gets its own session-scoped sandbox: no login needed and no shared state. Try the admin, edit content, hit the public site.

_{Tracks feat/delegated-release-service-15-d1-query-guard. Updated automatically when the playground redeploys.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: e24b6c8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-playground	e24b6c8	Jul 12 2026, 11:03 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-demo-do	e24b6c8	Jul 12 2026, 11:03 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-demo-cache	e24b6c8	Jul 12 2026, 11:03 AM

[emdashbot]

This PR takes the right approach to two related problems: it restores real-D1 query-count collection by isolating Core's runtime bundle validation from the Node-only Sigstore verifier, and it hardens the harness with integrity guards. The changes are surgical, well-scoped, and consistent with the repo's conventions.

What I checked:

• The new @emdash-cms/registry-verification/bundle export is correctly wired in package.json, built separately as platform: "neutral", and imported only by Core's marketplace code. Other consumers (plugin CLI) continue to use the full Node index entry, which is correct.
• bundle.ts itself references only modern-tar and plugin-types; the packed-output check guards against createRequire and @sigstore leaking into the bundle artifact.
• The stream-end marker is now emitted after flushRecorder(), so the integrity fence sits after the per-query log lines as intended.
• The query-count harness fails closed on non-2xx responses, detects missing/duplicate stream-end markers, and verifies that recorded query-event counts match the snapshot's dbCount. Hailing /search?q=static normalizes consistently between the route list and recorder url.pathname.
• stopChild() switches from "exit" to "close" and still escalates to SIGKILL on timeout, which is a cleaner shutdown for piped processes.
• Seed data contains the fixture slugs (development, webdev, about, building-for-the-long-term), so the measured routes should return 200.
• Changeset coverage is addressed via the existing canonical-bundle-verification.md changeset on the integration branch.

No blocking issues or AGENTS.md violations found. The code is genuinely clean.