chore!: drop the bootstrap invite flow from the messaging contract

[Bccorb]

Summary

Final step of removing the admin bootstrap invite flow across the ecosystem. The Seamless Auth API dropped it (fells-code/seamless-auth-api#112, merged) and the Express adapter no longer requests that delivery (fells-code/seamless-auth-server#116), so nothing in the ecosystem calls sendBootstrapInviteEmail. The first admin is granted through OWNER_EMAIL now.

Worth flagging: unlike the other repos in this sweep, this is not purely dead-code removal. This package is provider-agnostic and its stated product boundary was four auth flows, so removing the fourth narrows the boundary rather than just deleting something unreachable. That is reflected in the docs below.

Changes

@seamless-auth/messaging (core)

• src/transports.ts: removed sendBootstrapInviteEmail from AuthMessagingService and AuthMessagingHandlers, plus the bootstrapInviteEmail override.
• src/messages.ts: removed SendBootstrapInviteEmailInput.
• src/service.ts: removed the sendBootstrapInviteEmail implementation and the buildBootstrapInviteText / buildBootstrapInviteHtml default template builders.

Docs

• README.md, packages/core/README.md, AGENTS.md, docs/architecture.md, docs/provider-model.md, docs/adopter-user-story.md, docs/roadmap.md: the flow list, launch matrix, contract snippets, and default-template list now describe three auth flows instead of four.

Examples

• examples/seamless-review-api/src/localSmoke.ts: dropped the bootstrap invite smoke call.
• examples/seamless-review-api/src/withAuthMessageAudit.ts: dropped the sendBootstrapInviteEmail wrapper and its audit-entry variants.

No changeset: this repo does not use Changesets (no .changeset/, and release goes through release:verify plus the publish:* scripts). Versions are unchanged, so publishing is still a deliberate manual step.

Breaking changes

AuthMessagingService and MessagingClient no longer expose sendBootstrapInviteEmail, and SendBootstrapInviteEmailInput is no longer exported. Callers of that method break at compile time. Adopters supplying it as a custom handler or an override should drop the entry.

Verification

npm run release:verify (lint, format:check, typecheck, test) passes end to end:

• eslint .: clean
• prettier . --check: all files match (packages/core/src/transports.ts was reformatted after the import list shrank to one line)
• tsc -b --pretty false: clean
• node --test tests/providers.test.mjs: 7 passing, 0 failing

The examples/ directory is not part of the tsc -b project references, so it is lint-covered but not typechecked by the repo's own tooling. An ad-hoc tsc --noEmit over the example sources reports no errors from this change (withAuthMessageAudit.ts still satisfies MessagingClient); the one error it surfaces is a pre-existing SES mock in localSmoke.ts missing $metadata, untouched here.