feat(deps): file-based secure-exec deps with transient publish-time version swap

[NathanFlurry]

• The committed dependency state is now permanently FILE-BASED: every @secure-exec/* npm dep is link:../secure-exec/..., every secure-exec-* crate a path dep, and every @agentos-software/* registry package a link: into ../secure-exec/registry/{software,agent}/* — local development needs no mode flipping
• New committed secure-exec.ref pins the secure-exec sha; just secure-exec-bump [sha] advances it, and CI materializes + builds the sibling at that sha (prepare-build, cached per sha)
• CI gate verify-file-deps (plus the inverted check-no-escaping-local-deps, which now sanctions exactly the ../secure-exec escape) rejects any branch that commits published-version pins
• Publish workflows swap to real versions transiently via secure-exec-dep.mjs release-swap: previews auto-cut (or reuse) a secure-exec preview at the committed ref (agentos-dep-<sha7> branch/dist-tag, needs the SECURE_EXEC_DISPATCH_TOKEN secret); releases require --secure-exec-version <v> to be a real secure-exec release verified on npm AND crates.io
• Dependency tracks split: secure-exec-* recipes manage the runtime track, new agentos-pkgs-local/pinned/status/set-version/update recipes manage the per-package-versioned registry track
• Rewrite the Building Binaries docs page for the new registry recipes, add a Publishing Packages docs page, and update CLAUDE.md + the preview-publish skill for the new model

Pairs with rivet-dev/secure-exec#222 (which also makes secure-exec previews publish the registry packages under the branch dist-tag).

[railway-app]

🚅 Deployed to the agentos-pr-1587 environment in agentos

Service	Status	Web	Updated (UTC)
agentos	😴 Sleeping (View Logs)	Web	Jul 2, 2026 at 11:07 pm

---

🚅 Environment agentos-pr-1587 in rivet-frontend has no services deployed.

[NathanFlurry]

Superseded by the forklift stack: #1590 (file-based deps model) + #1591 (fully dynamic default software).