chore(fleet): repin to the pack with current dispatch routing

Author: jdalton

.config/repo/socket-wheelhouse.json

@@ -6,8 +6,8 @@
   "schemaVersion": 1,
   "repoName": "socket-cli",
   "bundle": {
-    "ref": "fleet-pack-cb228b0261d205472ce5bc7984369d2db7022c6a",
-    "cascadeSha": "cb228b0261d205472ce5bc7984369d2db7022c6a"
+    "ref": "fleet-pack-3954896128fd0bdb5c2bb128a426c6778e86f077",
+    "cascadeSha": "3954896128fd0bdb5c2bb128a426c6778e86f077"
   },
   "repo": {
     "type": "mono"

CLAUDE.md

@@ -120,7 +120,7 @@
 - 🚨 npm-family auth (npm/pnpm/yarn publish/login) uses BROWSER auth (`--auth-type=web`); NEVER pass or suggest `--otp=<code>`. [`token-hygiene`](docs/agents.md/fleet/token-hygiene.md)
 - 🚨 Verify state before acting: read a resource's published state before any create/claim/publish (`npm view` / `gh release view`). (`.claude/hooks/fleet/verify-before-publish-guard/`) [`verify-state-before-acting`](docs/agents.md/fleet/verify-state-before-acting.md)
 - 🚨 Publish through the pipeline, never locally: no `npm|pnpm publish` / `pnpm stage publish` / `cargo publish` / direct `npm-publish.mts` runs. [`version-bumps`](docs/agents.md/fleet/version-bumps.md)
-- 🚨 ONE npm upload invocation fleet-wide (`publish-infra/npm/publish-command.mts`); no npm token ever reaches CI, `direct` is only ever a LOCAL `0.0.0` name reservation, and a `Skipped OIDC` run that exits 0 still fails. (`scripts/fleet/check/publish-entrypoints-are-fleet-composed.mts`) [`trusted-publishing-posture`](docs/agents.md/fleet/trusted-publishing-posture.md)
+- 🚨 ONE npm upload invocation fleet-wide (`registry-infra/npm/publish-command.mts`); no npm token ever reaches CI, `direct` is only ever a LOCAL `0.0.0` name reservation, and a `Skipped OIDC` run that exits 0 still fails. (`scripts/fleet/check/publish-entrypoints-are-fleet-composed.mts`) [`trusted-publishing-posture`](docs/agents.md/fleet/trusted-publishing-posture.md)
 - 🚨 npm sits behind bot management: reuse the seeded session, and PAUSE a human-verification challenge for the operator via `runChallengeAware`; never blind-retry into a rate limit. [`npm-anti-bot-rhythm`](docs/agents.md/fleet/npm-anti-bot-rhythm.md)
 - 🚨 Validate what SHIPS, not the source tree: the packed tarball's bytes (closed entry allowlist, regular files only, no `..`/backslash entries, bin exec bits) plus a leak scan of packed AND decompressed bytes. [`artifact-hygiene`](docs/agents.md/fleet/artifact-hygiene.md)
 - 🚨 A `github-action` member ships the committed `dist/` at a tag: only rebuild-and-diff proves currency (git ancestry proves staleness alone), and a floating `v<major>` alias either tracks its line's newest release or does not exist. (`scripts/fleet/check/github-action-aliases-are-not-frozen.mts`) [`github-action-release-contract`](docs/agents.md/fleet/github-action-release-contract.md)

pnpm-lock.yaml

@@ -375,9 +375,6 @@ minimumReleaseAgeExclude:
   # trumps the soak heuristic for this one pinned version. Scoped to
   - '@stuie/*'
   - '@ultrathink/*'
-  # @yuku-parser 0.5.31 — third-party native parser; the per-platform binding
-  # family pinned to the exact version (a scope glob would blanket-bypass any
-  # future @yuku-parser publish). Published within the 7-day soak.
   # oxfmt 0.55.0 — the formatter; bumped from 0.48.0 for its jsdoc fixes.
   # The main package + per-platform binding family are pinned to the exact
   # version (a scope glob would blanket-bypass any future @oxfmt publish). All
@@ -406,10 +403,6 @@ minimumReleaseAgeExclude:
   # markdownlint-cli2 0.23.1's vulnerable 5.2.1 exact-pin. Soak bypassed per
   # the high-severity security exception; exact-pinned so a future version
   # re-soaks.
-  # yuku 0.8.0 — the transitive napi tree behind rolldown-plugin-dts
-  # 0.27.14 (same owner directive as its entry above: build-only dts
-  # emitter, never shipped to runtime). Core packages + both per-platform
-  # binding families, exact-pinned so future versions re-soak.
   # published: 2026-08-04 | removable: 2026-08-11
   - '@socketsecurity/lib@6.5.3'
   # published: 2026-08-03 | removable: 2026-08-10