fix(test): resolve NetScript packages from the workspace, not JSR at the unpublished release version

[rickylabs]

Summary

Two tests resolved NetScript packages from the live JSR registry at the workspace's own declared
version (jsr:@netscript/...@${NETSCRIPT_RELEASE_VERSION}). On a release branch that version is by
construction unpublished, so check-test could never be green and main's ruleset refused the
release merge — the last blocker on stable 0.0.4. Both tests now resolve @netscript/* from the
repository workspace (deno --config <repo>/deno.json), which is what they can honestly prove
pre-publish; registry-artifact resolution is owned by the post-publish production smoke.

Closes #1165

Why workspace resolution (and not version-pinning or a skip)

• A test that requires its own artifact to already be published is circular on every release
  branch. Ecosystem research (Deno @std, Fresh, oak, Hono; changesets, release-please,
  semantic-release, Lerna/Nx) shows the dominant mature pattern is exactly this split: source /
  workspace resolution before publish, exact-published-version smoke after publish.
• Pinning to the previous release was rejected: it tests the wrong code (the old package
  surface against new generated glue), and re-blocks the release branch whenever a release
  intentionally changes that surface.
• Skipping when unpublished was rejected: coverage would silently disappear at exactly the
  release-PR stage — the false-green class this release has already been burned by.
• The published-artifact leg is not taken on faith: e2e-cli-prod.yml installs
  jsr:@netscript/cli@<published version> and runs the full scaffold.runtime suite with
  --source jsr after every publish (verified in the workflow), which exercises published sagas
  runtime resolution and plugin installs against the real registry artifacts.

Changes

• packages/cli/src/public/features/generate/plugins/installed-runtime-registry-integration_test.ts
  — the saga-runtime test imports the same public /runtime export subpath consumers use, but
  resolves it via the repository workspace config instead of
  jsr:@netscript/plugin-sagas@<release version>. Renamed from "published dependency ..." to
  "packaged runtime export ..." so the name states what it proves.
• plugins/ai/tests/adapter/no-samples-install_test.ts — the generated workspace type-check runs
  deno check --config <repo>/deno.json, resolving @netscript/ai from workspace source instead
  of the consumer scaffold's unpublished-on-release-branch JSR pins. The --no-samples shape
  assertions are unchanged.

Proof under release conditions (all five steps observed, not asserted)

Reproduced with the worktree bumped to unpublished 0.0.4 exactly the way release:cut does
(version:bump 0.0.4 + gen:publish-assets + gen:assets-barrel):

1. Failure reproduced at 0.0.4 (pre-fix): saga test failed with subprocess exit 1
   (jsr:@netscript/plugin-sagas@0.0.4 unresolvable); ai test failed with
   Could not find version of '@netscript/ai' that matches specified version constraint '0.0.4'.
2. Fix applied (this diff).
3. Pass at unpublished 0.0.4: integration file 9 passed | 0 failed; ai test
   1 passed | 0 failed.
4. Pass at 0.0.3 after reverting the bump: 9 passed | 0 failed and 1 passed | 0 failed.
5. Guards still guard (demonstrated, both directions): temporarily renaming the
   startSagaRunner export in plugins/sagas/src/runtime/mod.ts → saga test FAILED;
   temporarily renaming the createMcpTransportPool export in packages/ai/mcp.ts → ai test
   FAILED. (A first demo attempt broke createToolRegistry, which the --no-samples glue does
   not import and correctly did not fail — the demo was repeated against a symbol the glue actually
   uses.) Both breakage edits reverted.

Audit of the other NETSCRIPT_RELEASE_VERSION test files

All seven remaining files were run empirically at the unpublished 0.0.4:
workspace-mutator_test.ts, registry-deno-json_test.ts, version-drift_test.ts,
deno-agent-docs-generator_test.ts, init-agent_test.ts, ai-plugin-command_test.ts,
dispatch-plugin-verb_test.ts — 45 passed, 0 failed. They build specifier strings or stub
fetches and never resolve the live registry at the declared version; no latent trap found.

Validation

• deno fmt --check / deno lint / deno check --unstable-kv on both changed files — clean.
• Full deno task test at 0.0.3 — 2623 passed (567 steps) | 0 failed | 16 ignored (2m57s).

🤖 Generated with Claude Code

https://claude.ai/code/session_01TH3jmm3ca7XVjTscYEyDoC