fix(coding-agent): respect CalVer update ordering

[code-yeongyu]

Summary

• compare Senpi YYYY.M.D-N releases using the repository's revision contract instead of npm prerelease ordering
• prevent senpi update from downgrading 2026.7.30-2 to the older bare 2026.7.30 release
• prepare and validate the complete 2026.7.30-2 release, including detailed changelogs, generated locks, and runtime dependency updates

Root cause

npm semver treats 2026.7.30-2 as a prerelease older than 2026.7.30. Senpi's CalVer contract instead treats the bare date as revision 1 and -2, -3, and later suffixes as newer same-day releases.

Verification

• RED proof: npm semver reports 2026.7.30 > 2026.7.30-2
• focused regression: packages/coding-agent/test/version-check.test.ts — 9/9
• merged update/goal regression set — 57/57
• npm run check
• CI=1 npm test
• Senpi QA: common 9/9, CLI 8/8, RPC 4/4, mock loop 43/43, TUI 5/5, PTY 8/8
• live registry check from source: 2026.7.30 is not offered as an update to 2026.7.30-2

Release artifact

• version: 2026.7.30-2
• canonical local tarball SHA-256: b4e9cd732762e355a1c71cfb7fb82673d56650947d7fc5aabd444e74833545b0

---

Summary by cubic

Switch Senpi update checks to CalVer ordering (YYYY.M.D-N) so same‑day revisions sort correctly and senpi update won’t downgrade 2026.7.30-2 to 2026.7.30. Prepares the 2026.7.30-2 release with refreshed locks, a release/installation guide, and small dependency updates.

• Bug Fixes

  • Compare versions using the Senpi CalVer contract (bare date = revision 1), with focused tests to prevent same‑day downgrades.

• Dependencies

  • Bumped @modelcontextprotocol/sdk to 1.30.0.
  • Overrode brace-expansion to 5.0.8 to address GHSA-mh99-v99m-4gvg.
  • Updated internal packages to 2026.7.30-2 and regenerated lockfiles.

^{Written for commit 19f6ea1. Summary will update on new commits.}