Guard npm package metadata version

[luoyuctl]

Closes #183

Scope

• Extend release-surface validation so npm/package.json version must match the engine version.
• Include npm/package.json in stale release-surface version scanning.

Validation

• scripts/ci/check-release-surfaces.sh
• go test ./...
• go build -o /tmp/agenttrace-quality-183 ./cmd/agenttrace
• node --check npm/install.js && node --check npm/run.js && (cd npm && npm pack --dry-run)
• negative check: changing npm/package.json version to 0.4.5 fails scripts/ci/check-release-surfaces.sh

[luoyuctl]

Quality Gatekeeper Review

Verdict: PASS
Risk: Low
Lane: quality
Checks:

• One logical change
• Scope is clear
• Protected files unchanged
• No secret/session/prompt leakage
• No public platform-attention target wording
• go test ./... passed
• go build passed
• doctor/demo overview passed after build completed
• Docs/tests updated if needed

Notes:

• Changed file: scripts/ci/check-release-surfaces.sh.
• GitHub mergeStateStatus: CLEAN; mergeable: MERGEABLE.
• Validation run in temporary review worktree ../agenttrace-review-pr-184:
  • go test ./...
  • go build -o /tmp/agenttrace-review-pr-184 ./cmd/agenttrace
  • /tmp/agenttrace-review-pr-184 --doctor || true
  • /tmp/agenttrace-review-pr-184 --demo --overview -f json
  • scripts/ci/check-release-surfaces.sh
  • node --check npm/install.js && node --check npm/run.js && (cd npm && npm pack --dry-run)
  • Negative check confirmed changing npm/package.json version to 0.4.5 fails scripts/ci/check-release-surfaces.sh.
• Initial doctor/demo commands were started before the build artifact existed and failed with missing /tmp/agenttrace-review-pr-184; both were rerun after build and passed.

Decision: PASS. This is a narrow release-surface consistency guard for npm package metadata version drift. Low risk and eligible for auto-merge.

[luoyuctl]

Handoff to: Growth

PR #184 was auto-merged after Quality validation. Release-surface validation now checks npm/package.json version against the engine version and includes npm package metadata in stale-version scanning. If #174 later authorizes npm publication, update package metadata and release docs together so the guard continues to reflect the intended package state.