chore: bump bulletin-deploy 0.6.9 -> 0.6.16

[UtkarshBhardwaj007]

Summary

Bump the bulletin-deploy pin from 0.6.9 → 0.6.16. Every API we consume (deploy, DeployContent, DeployOptions, DeployResult, DotNS) still exports with compatible shapes — no source changes required.

Notable upstream changes picked up:

• PR #126 (0.6.13) — merkleizeJS now produces complete DAG-PB CARs. Replaces the MemoryBlockstore with a CidPreservingBlockstore so the CAR body indexes DAG-PB structural blocks under their real codec (not rebuilt as raw). This is the upstream fix the jsMerkle: true workaround in CLAUDE.md was waiting on. Not flipped on in this PR — that's a separate decision with its own testing.
• PR #130 (0.6.14): DotNS verifies on-chain after every setContenthash write.
• PR #128 (0.6.14): actionable preflight messages when a label sanitizes into Reserved.
• PR #98 (0.6.11): commit-reveal waits on chain time, not wall-clock — fewer spurious failures on flaky Paseo blocks.
• PR #96 (0.6.11): idempotent pool topUpBy + DotNS commit-reveal verification.
• PR #144 (0.6.16): bulletin-deploy drops the legacy --playground publish path. We never used it — registry.publish() stays on our side so env::caller() is the user, per CLAUDE.md.

New opt-in DeployOptions fields (derivationPath, tag, ghPagesMirror) are not consumed by us.

Test plan

• pnpm install succeeds; lockfile regenerated cleanly.
• pnpm test → 21 files / 189 tests pass.
• Smoke-test a real dot deploy against Paseo in a follow-up before release cut.

[github-actions]

Dev build ready — try this branch:

curl -fsSL https://raw.githubusercontent.com/paritytech/playground-cli/main/install.sh | VERSION=dev/chore/bump-bulletin-deploy-0.6.16 bash

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	bulletin-deploy@​0.6.9 ⏵ 0.6.16	-5

View full report