chore: remove sandbox app and standalone-only infra

[pat-lewczuk]

Why

Prepares official-modules to live as a subrepository inside the open-mercato repo, where the parent app becomes the module host. With that model, the sandbox app (and the standalone-only tooling that existed only to serve it) is dead weight.

What changed

Removed — sandbox host (Tier 1)

• apps/sandbox/ (full app), scripts/sync-sandbox.sh, root docker-compose.yml (postgres/redis/meili were sandbox-runtime), and the sandbox passthrough scripts (dev, start, generate, initialize, reinstall, mercato, build:sandbox, sync).

Removed — verdaccio local registry (Tier 2)

• scripts/registry/, scripts/publish-preview.sh (published to localhost:4873, not npm), verdaccio service, and registry:* / publish:preview scripts.

Removed — platform-sync (Tier 3)

• Channel pinning is moot inside the parent: platform-sync scripts, config/, orphaned run-tests.mjs, and platform:sync* / test:root / test:scripts scripts.

Rewrote ci.yml (Tier 4)

• Dropped both "Check platform sync" steps and PLATFORM_CHANNEL.
• Collapsed the build → generate → rebuild sequence (it relied on the sandbox to host mercato generate) to a single build:packages, with a TODO(subrepo) marking where the parent repo's codegen needs wiring in.
• The integration-test job's yarn generate is untouched — it runs inside the scaffolded standalone app.

⚠️ Non-obvious: the sandbox was load-bearing for typecheck

The sandbox transitively dragged the platform dependency closure (@mikro-orm/*, zod, awilix, bullmq, @open-mercato/cache|events|search, …) into root node_modules, which is what let tsc resolve types inside @open-mercato/shared. To keep this repo self-sufficient, that closure is re-added as root devDependencies — pinning mikro-orm to ^6.5.9 to match the module peer requirement (the sandbox's v7 mismatched).

Verification

build:packages ✅ · check:dep-versions ✅ · i18n:check-sync:packages ✅ · typecheck ✅ · test ✅ (162 passed). Lockfile regenerated.

Follow-ups (not in this PR)

• TODO(subrepo) in ci.yml — wire the parent repo's mercato generate once exposed.
• Docs — README.md / CONTRIBUTING.md / AGENTS.md still describe the sandbox dev loop; rewrite once the parent-repo workflow is settled.

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ pat-lewczuk
❌ neverwriter
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[pat-lewczuk]

CI investigation & merge-conflict resolution

Two separate problems were blocking this PR. The first is fixed; the second is a design decision left to maintainers.

1. ✅ Failing check — Integration test — carrier-inpost

It died at Scaffold standalone app. create-mercato-app gained an interactive agentic setup wizard that (unlike its preset/git prompts) has no TTY guard, so in CI it blocks on stdin and the step exits with code 13. Fixed by scaffolding non-interactively, matching what develop already does:

npx --yes create-mercato-app@$CREATE_APP_TAG /tmp/standalone-app --preset classic --skip-agentic-setup --no-init-git --registry https://registry.npmjs.org

2. ✅ Merge conflict with develop — resolved (branch is now MERGEABLE)

• .github/workflows/ci.yml — resolved (scaffold line matches develop)
• apps/sandbox/package.json, config/platform-channel-policy.json — kept deleted
• yarn.lock — regenerated from develop's lock with the sandbox workspace pruned
• package.json — dependencies/devDependencies aligned exactly with develop; stale 0.4.9 @open-mercato/* pins and MikroORM v6 dropped

⚠️ Open item for maintainers — post-merge test (typecheck)

The merged test job still fails at yarn typecheck. Root cause: the published @open-mercato/{ui,core,shared} packages declare exports.types → ./src/*.ts (source, no shipped .d.ts), so packages/* typecheck the entire published source tree. That source needs the full app dependency closure (~79 third-party deps: @tanstack/react-query, @radix-ui/*, ai-sdk, stripe, newrelic, …), which on develop is provided by the sandbox app. Removing the sandbox removes that environment.

yarn install --immutable and yarn build:packages pass; only typecheck is affected. Options:

1. Declare the closure at the root package.json (mechanical; matches the upstream types→src design; bloats root).
2. tsconfig override so @open-mercato/* resolves to built dist/*.js instead of source (leaner root, but weakens type-checking of those APIs and edits shared tsconfig.base.json).
3. Upstream fix — publish .d.ts / point exports.types at dist so consumers don't compile source (out of this repo's scope).

I've left the root deps at develop's baseline so whichever direction you choose starts from a clean state.