fix(release): pin squad-sdk to the exact published version in publish-cli

[omercangumus]

What

squad-npm-publish.yml's publish-cli job now rewrites the published packages/squad-cli/package.json's @bradygaster/squad-sdk dependency to an exact version pin, right before build/publish.

Why

Closes #1588

packages/squad-cli/package.json declares "@bradygaster/squad-sdk": ">=0.11.0" — a floor, no ceiling. Pinning a CLI version (npx @bradygaster/squad-cli@0.11.0) doesn't pin the SDK it installs, since */>= both float to whatever's latest on the registry at install time. The SDK carries the presets and agent charters, so the first 0.12.0 SDK publish silently changes behavior for every consumer pinned to squad-cli@0.11.0, with no version bump visible anywhere and no way to roll back by pinning. That's exactly the failure mode CI version pinning (e.g. the gh-aw shared component's SQUAD_CLI_VERSION) exists to prevent.

Went with the fix the issue itself suggested: pin exact at publish time, keep the floor range in source. Skipped the workspace:* idea also mentioned in the issue — npm doesn't support that protocol (it's pnpm/yarn syntax), committing it would make npm install try to fetch a package literally named workspace:* and fail. This repo already handles workspace resolution the normal npm-workspaces way (root workspaces: ["packages/*"]), which doesn't care what semver range is declared as long as the local version satisfies it — so leaving the floor range in source doesn't need to change for local dev to keep working.

How

• .github/workflows/squad-npm-publish.yml: new step Pin squad-sdk dependency to the exact published version (#1588) in the publish-cli job, between the existing #1203 resolvability check and the SDK build step. Rewrites packages/squad-cli/package.json's SDK dependency to steps.version.outputs.version — the same version string already used by every other step in this job (Determine version, Verify package version matches target), and the same value publish-sdk just published and verified is live on the registry (this job needs: [..., publish-sdk]). Follows the exact same node -e "... '$VAR' ..." bash-into-node interpolation style squad-version-promote.yml already uses for its own package.json rewrites, rather than inventing a new convention.

Testing

• Dry-ran the exact transformation logic against a scratch copy of packages/squad-cli/package.json (real run, not hypothetical):

  === BEFORE ===
  194:    "@bradygaster/squad-sdk": ">=0.11.0",
  Pinned @bradygaster/squad-sdk dependency to 0.12.0
  === AFTER ===
  194:    "@bradygaster/squad-sdk": "0.12.0",
  === full file still valid JSON? ===
  valid JSON
  

  Confirms the rewrite lands the right field, produces valid JSON, and preserves the file's existing 2-space formatting.
• No actionlint/shellcheck available locally on this Windows box — this repo's Workflow Lint job runs both against .github/workflows/** on every PR that touches it, so CI is the real check here.
• git diff vs git diff -w identical, no whitespace-only hunks. File has no CRLF (plain LF), untouched by that concern.

---

⚠️ Quick Check

• No changeset — this PR only touches .github/workflows/squad-npm-publish.yml. The repo's own changelog-gate regex (SDK_CLI_PATH_REGEX in squad-ci.yml) is scoped to packages/squad-*/src|templates, .squad-templates/, templates/, and agent charters — .github/workflows/ isn't in it, and PR_REQUIREMENTS.md lists "Infrastructure (CI, GitHub Actions, workflows)" under "What Is NOT User-Facing". Structural exemption, not a waiver.

PR Readiness Checklist

Branch & Commit

• Branch created from dev
• Branch is up to date with dev
• Verified diff contains only intended changes (single workflow file, +17)
• PR is not in draft mode
• Commit history is clean (single commit)

Build & Test

• No source/test code changed — workflow-only. Logic dry-run above; YAML/shellcheck validated by this repo's Workflow Lint CI job.

Changeset

• N/A — structural exemption, see Quick Check above

Docs

• N/A — no public API/CLI surface changed

Exports

• N/A

---

Breaking Changes

None. Published CLI package.json content changes (exact pin instead of a floor range) but the semver range this replaces already permitted that exact version — nothing that installs today stops resolving.

Waivers

None.

[github-actions]

🟢 Impact Analysis — PR #1638

Risk tier: 🟢 LOW

📊 Summary

Metric	Count
Files changed	1
Files added	0
Files modified	1
Files deleted	0
Modules touched	1

🎯 Risk Factors

• 1 files changed (≤5 → LOW)
• 1 module(s) touched (≤1 → LOW)

📦 Modules Affected

ci-workflows (1 file)

• .github/workflows/squad-npm-publish.yml

---

This report is generated automatically for every PR. See #733 for details.

[github-actions]

🏗️ Architectural Review

⚠️ Architectural review: 1 info.

Severity	Category	Finding	Files
ℹ️ info	template-sync	Template files changed in .github/workflows/ but not in other template locations. If these templates should stay in sync, consider updating the others too.	Changed: .github/workflows/, Unchanged: templates/, .squad-templates/, packages/squad-cli/templates/

---

Automated architectural review — informational only.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit 8aacc60

PR Scope: 🔧 Infrastructure

⚠️ 2 item(s) to address before review

Status	Check	Details
✅	Single commit	1 commit — clean history
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	No source files changed — changeset not required
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	No Copilot review threads
❌	CI passing	8 check(s) still running

Files Changed (1 file, +17 −0)

File	+/−
.github/workflows/squad-npm-publish.yml	+17 −0

Total: +17 −0

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.