Enforce published runtime dependency floors

[goldmar]

Follow-up to #392 after a late exact-head Codex review identified that npm ignores overrides declared by installed dependencies.

This patch release fix:

• replaces ineffective published overrides with exact runtime dependencies and a published npm shrinkwrap
• pins the Claude/MCP runtime graph, including patched fast-uri, Hono, ip-address, node-server, and express-rate-limit versions
• verifies the packed artifact in an isolated npm consumer and audits that resolved graph
• applies the repository 24-hour release-age policy to every shrinkwrapped package and rejects undocumented exclusions
• adds bounded ClawHub post-publish verification backoff after the v4.7.7 propagation race
• bumps release metadata to 4.7.8

Verified locally:

• pnpm verify (98 test files)
• pnpm check-plugin-security
• pnpm verify:npm-consumer
• pnpm validate:release-metadata -- 4.7.8
• pnpm audit and pnpm audit --prod
• actionlint and git diff --check

No host plugin install, Gateway config change, restart, publish, or deploy was performed locally.

[goldmar]

@codex review

[github-actions]

Bundle Size Report

Runtime file	Size
dist/chunks/agent-pr.js	0.6 KB
dist/chunks/chunk.js	110.2 KB
dist/chunks/npm-release-client.js	0.2 KB
dist/index.js	422.5 KB
Total	533.5 KB

Limit	Status
600.0 KB	✅ Within limit

Complete bundle is within the 600.0 KB limit.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: e57163f4a7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".