chore: revendor sc-publish version-floor fix

[randlee]

Summary

Re-vendors plugins/sc-publish/ (and its self-installed root mirror) from sc-publish develop commit 42e0fce, which merged the upstream version-floor fix (sc-publish PR #50). This closes out the version-floor saga: sc-compose PR #531 was FAILed twice for hand-patching vendored files; the actual fix landed upstream instead, and this PR only consumes it.

Diff is exactly 4 mirrored files (root + vendored copies of bootstrap_sc_compose.py and test_publish_kit_scripts.py) — no Q.4 release-candidate/provenance content, since integrate/phase-q already has that from PR #530/#532.

Why

bootstrap_sc_compose.py is vendored byte-for-byte into every consumer via install.py's package_files(). Consumer-side patches to it (attempted twice on PR #531) drift from the canonical source and were correctly rejected by QA. The fix belongs upstream, and this PR is the re-vendor step that closes the loop, following the same consume-update pattern as Q.3/Q.4.

Test plan

• Vendor tree exact against sc-publish@42e0fce
• Root install/bootstrap mirrors exact (byte-identical to vendored copy)
• Installer dry run: exit 0
• python3 -m pytest .github/scripts/tests: 82 passed, 7 skipped, 3 subtests
• git diff --check: clean

🤖 Generated with Claude Code

[randlee]

Final Quality Report

Generated: 2026-08-20
QA Pass: QA-1
Sprint/Task: SC-COMPOSE-VERSION-FLOOR-REVENDOR-QA1 / sc-compose-version-floor-revendor-phase-q
Branch: fix/sc-compose-version-floor-revendor-phase-q
Commit: c3c4091
PR: #533
Final Verdict: PASS

Machine Status (JSON)

{
  "sprint": "SC-COMPOSE-VERSION-FLOOR-REVENDOR-QA1",
  "task": "sc-compose-version-floor-revendor-phase-q",
  "branch": "fix/sc-compose-version-floor-revendor-phase-q",
  "commit": "c3c4091",
  "pr": 533,
  "verdict": "PASS",
  "findings": {
    "blocking": 0,
    "important": 0,
    "minor": 1
  },
  "blocking_ids": [],
  "merge_readiness": "ready",
  "merge_reason": "All 5 stated deliverables independently verified closed with direct evidence (diff scope, byte-identical vendor/root mirrors confirmed against both the local worktree and actual upstream sc-publish@42e0fce, clean pytest run through the correctly-pinned venv). req-qa, arch-qa, and simplification-reviewer all PASS with 0 blocking/important findings; rust-qa-agent legitimately SKIPPED as out of scope for a pure-Python change. CI is fully green (14/14) and CLEAN. The RULE-012 violation class that FAILed PR #531 twice is conclusively closed at both the local-worktree and upstream-source level.",
  "next_action": "none",
  "owner": "none",
  "recommendation": "Merge PR #533 into integrate/phase-q. This closes out the sc-compose version-floor RULE-012 saga (PR #531 x2 FAIL -> sc-publish PR #50 upstream fix -> this re-vendor). Route the noted pre-existing install.py --dry-run README drift to a separate backlog item; it does not block this PR."
}

Validated Scope

• Diff vs origin/integrate/phase-q confirmed limited to exactly the 4 expected files (.github/scripts/bootstrap_sc_compose.py, .github/scripts/tests/test_publish_kit_scripts.py, and their plugins/sc-publish/ mirrors) via git diff origin/integrate/phase-q...HEAD --name-only.
• Both vendored files confirmed byte-for-byte identical to sc-publish develop@42e0fce via direct git show 42e0fce:plugins/sc-publish/.github/scripts/... comparison against upstream sc-publish repo -- deliverable Bootstrap standalone repo scaffolding #2 independently closed.
• Root .github/scripts/bootstrap_sc_compose.py and its vendored counterpart confirmed byte-identical (also independently confirmed by req-qa, arch-qa, simplification-reviewer) -- this is the exact RULE-012 drift class that FAILed PR fix: reject stale sc-compose Python bindings below version floor #531 twice, now fully closed.
• Root install.py vs plugins/sc-publish/install.py also confirmed byte-identical (adjacent-file drift check, not itself in the diff scope).
• python3 -m pytest .github/scripts/tests run through the correctly-pinned sc-compose==1.4.1 venv (provisioned via the PR's own bootstrap_sc_compose.py --venv): 82 passed, 7 skipped, 3 subtests passed, 0 failures -- matches dev-cited evidence exactly.
• Old exact-match violation (existing != SC_COMPOSE_VERSION) confirmed fully absent from both copies (grep + simplification-reviewer + arch-qa); replaced by a single version_components/require_version_floor >= comparison path, no duplicate/parallel validation logic.
• No Q.4 release-candidate/provenance content touched; superseded branch (fix/sc-compose-version-floor-revendor@f6c21fa, wrongly targeting develop) was NOT reviewed per task instruction.
• CI: 14/14 checks green (format, clippy, manifest-validation, python-wheels x3, sc-sha-go, sc-sha-python-wheel x3, test x3), mergeStateStatus CLEAN.
• rust-qa-agent correctly SKIPPED: pure-Python diff, no .rs/Cargo.toml files touched -- legitimate scope exclusion, same pattern as sc-publish PR feat: Phase HTML-Report (H1-H4) — FR-12 through FR-15 #50 earlier this session.

Findings Summary (Final)

• Blocking: 0
• Important: 0
• Minor: 1

Residual Risks

• Minor/non-blocking, pre-existing, out of this PR's scope: python3 install.py --dry-run --input release/sc-publish-install.json . returns exit 1 (README.md rendering drift against the install manifest) -- quality-mgr confirmed this reproduces byte-identically on origin/integrate/phase-q HEAD (f4525f3) before this PR's changes, and the drift touches only README.md content unrelated to the 4 files in this PR's diff. Not a regression introduced here; recommend team-lead route as a separate backlog item against integrate/phase-q.

Merge Readiness

• Status: ready
• Reason: All 5 stated deliverables independently verified closed with direct evidence (diff scope, byte-identical vendor/root mirrors confirmed against both the local worktree and actual upstream sc-publish@42e0fce, clean pytest run through the correctly-pinned venv). req-qa, arch-qa, and simplification-reviewer all PASS with 0 blocking/important findings; rust-qa-agent legitimately SKIPPED as out of scope for a pure-Python change. CI is fully green (14/14) and CLEAN. The RULE-012 violation class that FAILed PR fix: reject stale sc-compose Python bindings below version floor #531 twice is conclusively closed at both the local-worktree and upstream-source level.

Recommendation

Merge PR #533 into integrate/phase-q. This closes out the sc-compose version-floor RULE-012 saga (PR #531 x2 FAIL -> sc-publish PR #50 upstream fix -> this re-vendor). Route the noted pre-existing install.py --dry-run README drift to a separate backlog item; it does not block this PR.