fix(cli): make prod CLI plugin path usable + prod-local e2e suite (alpha.5)

[rickylabs]

What & why

Makes the production CLI path actually usable and adds a prod-local e2e suite that proves it. This is an alpha.5 prod blocker: previously netscript plugin add <name> was broken for every published-CLI user (it shelled out to deno dx, an invalid Deno 2.9 subcommand), and prod-mode scaffolding was missing first-party plugin dependencies, so a scaffolded prod project could not resolve sagas/streams/workers.

This branch was built as a daemon-attached WSL Codex slice and is not self-certified — it is opened for IMPL-EVAL.

Changes (by slice)

• test(cli): add prod-local e2e harness (45dab648) — new e2e:cli:prod task, .github/workflows/e2e-cli-prod-local.yml, and packages/cli/e2e/... prod-mode gates. The prod gate scaffolds via the local public bin but resolves @netscript/* from published JSR, exercising the real prod import surface (which maintainer/local mode never did).
• fix(cli): dispatch plugin verbs with deno x (c159ceb7) — dispatch-plugin-verb.ts now uses deno x -A jsr:<pkg>/cli <verb> (the correct Deno 2.9 npx-equivalent), replacing the invalid deno dx. Updated unit test, public-api.ts JSDoc, and the two docs refs (reference/cli, reference/streams). Also normalizes non-jsr: CLI entrypoints against project.repoRoot in the e2e gate factory (the prod gate was passing a relative CLI path that failed outside the workspace builder).
• fix(cli): wire prod plugin dependencies (8d854a50) — adds the missing prod import-map/dependency entries for copied official plugin workspaces (streams @durable-streams/server, worker @netscript/cron), generated worker runtime loading for .netscript/generated/plugin-workers/jobs.registry.ts, and Aspire GARNET_URI/REDIS_URI wiring so KV-backed queues/background processors use the shared Garnet resource instead of process-local fallback state. Includes the matching deno.lock delta.
• chore(harness): record prod-local evidence (3441d2cf) — run worklog.

Validation (raw, from worklog)

Gate	Result
Focused dispatch test	PASS (1 test, 4 steps, exit 0)
Scoped check packages/cli / plugins/workers / plugins/streams	PASS (520 / 77 / 21 files, 0 occurrences)
Scoped lint + fmt (changed TS)	PASS (0 findings)
Prod-local runtime smoke e2e:cli:prod	PASS 47/0, exit 0 (and a repeat run also PASS 47/0)
Maintainer runtime smoke scaffold.runtime	PASS 47/0, exit 0 (no regression)

deno.lock delta — read this

The lock change is workspace dependency-membership only for plugins/{auth,sagas,streams,triggers,workers} — it completes those members' declared @netscript/* (alpha.4) and @orpc/* / @durable-streams/* dependency lists. The author verified no package version re-resolution churn; the lock updated naturally via Deno resolution (no hand-edit, no --reload). This was supervisor-approved as legitimate prod dependency resolution. (It also suggests main's lock is missing these memberships — relates to the lock-hygiene task.)

Caveats for IMPL-EVAL

1. Published alpha.4 plugin CLI lacks the add verb. deno run jsr:@netscript/plugin-workers@0.0.1-alpha.4/cli add → Unknown command: add. The prod e2e exercises the dispatch mechanism + the copied-source plugin path; a true end-to-end deno x jsr:...@cli add against the registry closes only when alpha.5 republishes the plugins with the add verb. The dispatch fix here is correct and necessary; the published-verb gap is a release-train dependency, not a defect in this PR.
2. --minimum-dependency-age=0 is not threaded to nested plugin dispatch (only the top-level CLI runner). Once the published plugin add verb exists, nested deno x dispatch of a just-published package may need that flag or the dependency-age policy could block it. Forward-looking note.
3. Package-wide lint/fmt wrapper returned exit 1 with zero findings after one touched file was formatted. The green verdict used explicit changed-TS-file scoping (the correct source surface for this slice) — consistent with the scoped-wrapper gate-evidence rule. Not a real failure, but flagged for transparency.

Unrelated drift left untouched

Six pre-existing OpenHands line-ending-drift files (.llm/tmp/run/openhands/pr-{17,25,32,35,37}/...) were intentionally not staged.

🤖 Generated with Claude Code