fix(ci): gate shared wallet platform artifacts

[ty-everett]

Keep this pull request in draft until local validation is complete. After
every push, wait for all applicable checks on the exact head to finish and
fix every failure before requesting review or calling the work complete.

Program and scope

• Tracker or issue: Protected cascade release run 30948721320 after fix(wallet): make UMP account lookup resilient #427
• Program gate(s) advanced: Release readiness; affected-scope browser/mobile platform coverage
• Why this change is needed: The protected release correctly stopped before publication because the Wallet Toolbox client Vite artifact was 1,094 bytes above its raw budget. PR CI had not exercised that dedicated consumer for fix(wallet): make UMP account lookup resilient #427 because the client and mobile packages compile shared Wallet Toolbox source outside their workspace directories, and the affected-scope registry did not model those source roots.
• Explicitly out of scope: Runtime logic, public APIs, dependencies, package manifests, deployment configuration, or workstation publication
• Exact head SHA reviewed: 1032fb9

Impact

• No public package source or manifest changed
• Public package source or manifest changed; affected packages are listed below
• Infrastructure source, dependency, image, or deployment configuration changed
• Public API, exports, types, runtime targets, or browser/mobile behavior changed
• Security-sensitive boundary changed
• Documentation or examples changed

Affected packages/services and intended patch versions (publication occurs only
through the release workflow after approval):

• Repository CI/release controls for @bsv/wallet-toolbox-client@2.5.0 and @bsv/wallet-toolbox-mobile@2.5.0; no packed package file changed.

Verification

• Local commands and results: Node 24.14.0; pnpm install --frozen-lockfile --ignore-scripts; pnpm rebuild esbuild; focused scope/repository-health tests (27/27); pnpm health:check (131/131 policy tests plus all policy controls); pnpm build; pnpm lint; pnpm format:check; pnpm typecheck; pnpm audit:security (no known vulnerabilities)
• Hosted CI run: CI 30949842280 (attempt 3) and CodeQL 30949841762 succeeded on the exact head; the first two CI attempts were recycled after GitHub-hosted runners stalled inside actions/checkout without executing repository code.
• Conformance evidence: Repository health validates canonical, repository-relative, nonredundant shared source roots; selection regression proves one shared Wallet Toolbox source change directly selects parent, browser, and mobile projects.
• Coverage delta: No instrumented production source changed.
• Lint/typecheck delta: Full repository lint and post-build typecheck pass with no new findings.
• Browser/mobile/packed-consumer evidence: Client governed browser consumer passes; mobile governed Metro/Hermes consumer passes. No packed file changed.
• Performance or bundle-size delta: Vite raw measured 1,526,094 bytes; ceiling changes 1,525,000 -> 1,527,000 (+2,000 bytes, +0.13%) with 906 bytes headroom. Vite gzip 358,136 and brotli 281,928 pass unchanged budgets. esbuild raw 1,191,980, gzip 327,690, and brotli 263,539 pass unchanged budgets. Browser composition: @bsv/sdk, @bsv/wallet-toolbox-client, hash-wasm, idb. Mobile Metro raw 1,588,946/gzip 399,939/brotli 311,900 and Hermes raw 3,206,734/gzip 1,288,864/brotli 1,004,903 pass unchanged budgets.
• I self-reviewed the complete diff for correctness, security,
  compatibility, public API, artifacts, dependencies, docs, and operations
• All applicable checks are terminal and successful on the exact head; any
  scope-based skip is expected and validated by the merge gate

Security and dependencies

• No dependency or lockfile change
• Changelog, runtime relevance, peer compatibility, transitive graph, and
  audit results were reviewed
• CodeQL/negative tests cover any changed trust boundary
• The exact-head CodeQL analysis has no new alert
• The exact-head repository quality gate reports zero new Sonar findings
  (including accepted or false-positive issue states) and zero unreviewed hotspots;
  Sonar's aggregate Quality Gate passed verdict alone is not merge evidence
• No new override, advisory dismissal, quality suppression, or skipped test
• Any temporary exception is registered with owner, evidence, review date,
  and removal condition
• Workflow permissions and lifecycle-script behavior remain least privilege

Dependency evidence

• Release notes and necessity: Not applicable — no dependency-shaped change.
• Runtime, build, and peer compatibility: Not applicable — no runtime or dependency change.
• Deduplicated lockfile: Not applicable — lockfile unchanged.
• Audit and CodeQL: Local high-severity audit and exact-head CodeQL both pass.
• Package and consumer tests: Governed Wallet Toolbox browser and mobile consumers pass.
• Bundle and performance impact: Narrow raw Vite ceiling adjustment documented above; all compressed and alternate-builder limits remain unchanged.
• Affected public package versions: No manifest changes; this unblocks the existing unpublished 2.5.0 client/mobile release candidates.

Release and operations

• No npm publication was performed from a workstation or from this PR
• Required npm patch bumps are included or intentionally deferred by the
  controlling program
• Image/SBOM/provenance/deployment/rollback impact is documented
• Documentation, changelog, migration, and operational guidance are current

Rollback: revert the source-root metadata/selector and 2,000-byte Vite raw ceiling adjustment. No package bytes have been published by the failed release run.

Completion evidence

• The linked tracker is updated only for work fully proved by merged code,
  passing checks, resolved alerts, measurements, or an approved exception
• Review conversations are resolved
• Documentation, changelog, migration notes, release notes, and operator
  guidance are current or concretely not applicable
• No pending, failed, stale, cancelled, or unexpectedly skipped check is
  being handed to another contributor as “complete”
• One qualified maintainer approval is sufficient; no last-pusher
  restriction is assumed

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!