release: cut system misses markdown version mentions + @netscript/ai (and siblings) absent from the publish set

[rickylabs]

Found during the beta.6 release-ready run + doc pass (orchestrator fb43bc3e). Two related gaps in the release-cut pipeline:

1. Markdown is outside the version-bump surface

.llm/tools/release/cut.ts / publish-workspace.ts bump deno.json versions (and the CLI scaffold specifiers track cliPackageJson.version via NETSCRIPT_RELEASE_VERSION), but no step updates version mentions in markdown. Stale today on main:

• README.md:39,215 — claims 0.0.1-alpha.1 (current line is beta.5, beta.6 imminent)
• packages/sdk/README.md:31 — install snippet pins jsr:@netscript/sdk@^0.0.1-alpha.1
• packages/fresh/src/application/form/README.md:16 — ^0.0.1-alpha.0
• docs/architecture/DOCS-STRUCTURE.md, STANDARDS.md — ^0.0.1-alpha.0 specifier examples
• docs/site/** — several "arrives from 0.0.1-beta.2" claims about @netscript/ai

The immediate README-layer instances are being fixed (version-neutral install snippets) in the beta.6 doc pass; docs/site is deferred to the beta.7 docs cut (#445/#448).

2. @netscript/ai beta surface was never published

JSR dist-tags: @jsr/netscript__ai latest = 0.0.1-alpha.0 (stale) while @jsr/netscript__telemetry = 0.0.1-beta.5. So the cut's publish set has been skipping packages/ai for the entire beta line. This surfaced three times in the beta.6 run: the #258 ui:add ai smoke (copied files reference unpublished @netscript/ai@^0.0.1-beta.5), the #597 local-source mapping gate, and the T8 rescope. packages/plugin-ai-core likely shares the gap — audit the full publish set vs the workspace.

Acceptance

• Release cut fails preflight (or auto-fixes) when markdown contains version pins behind the cut version — or a repo policy establishes version-neutral install snippets and the cut lints for violations.
• Publish-set audit: every gate:jsr workspace package is either in the cut's publish set or explicitly excluded with a recorded reason; @netscript/ai + plugin-ai-core included for beta.6.
• e2e-cli-prod (or a new gate) would catch a scaffold that references an unpublished @netscript/* version.

Refs #599 #601. Filed pre-publish so the beta.6 cut can include the publish-set fix.

Acceptance evidence

• Markdown lint and deferred-site output: PR fix(release): include @netscript/ai in publish set + markdown version-pin preflight (#609) #612 IMPL phase comment fix(release): include @netscript/ai in publish set + markdown version-pin preflight (#609) #612 (comment)
• Full publish-set audit (34 members, AI surfaces included, explicit benchmark exclusion): fix(release): include @netscript/ai in publish set + markdown version-pin preflight (#609) #612 (comment)
• Unpublished-reference defect class: the publish:false fixture proves the preflight fails when an intended @netscript package drops from the effective publish set; 23/23 release tests in the same evidence comment.
• Independent final evaluator: PR fix(release): include @netscript/ai in publish set + markdown version-pin preflight (#609) #612 IMPL-EVAL phase comment (posted after this issue update).