chore: retire PickForge IDE with v0.2.1

[ElbertePlinio]

Why

The IDE is being retired and pickforge/pickforge will become the successor product's repository. Existing v0.2.0 installs must update once without ever treating the successor's latest.json as an IDE update.

What

• bumps the final IDE release to v0.2.1 across npm, Tauri, the Rust workspace, and Cargo.lock
• points the shipped updater endpoint at pickforge/pickforge-ide
• adds a one-time, dismissible studio-chrome retirement notice with successor and archive links
• adds the retirement banner, final release note, updater documentation, and finalizes the unreleased notes
• makes the final release workflow use the checked-in v0.2.1 note
• adds RUNBOOK.md for release, verification, rename, canonical manifest replacement, archive, site handoff, and wrong-manifest recovery

Updater mechanics after the rename

@pickforge/tauri-release discovers signed bundle assets and writes each platform URL from the explicit --download-base-url; pickforge.release.json.repository is metadata and does not determine those URLs.

The release is intentionally cut while the repository is still pickforge/pickforge. The workflow's first manifest therefore uses the old download base so an installed v0.2.0 can fetch, verify, install, and relaunch into v0.2.1 before the rename. GitHub carries the release and assets through the rename, but that redirect cannot remain the long-term contract because the old path will be reused.

Immediately after gh repo rename pickforge-ide, the runbook downloads the signed assets, regenerates and verifies latest.json with the canonical pickforge/pickforge-ide/releases/download/v0.2.1 base, and uploads it with --clobber before archiving. The v0.2.1 binary itself already checks the explicit pickforge-ide/releases/latest/download/latest.json endpoint. The successor must never publish an asset named latest.json, so any remaining v0.2.0 client gets a safe 404 rather than successor metadata.

How it was verified

• bun install --frozen-lockfile
• bun run pickforge-tauri-release validate-config
• synthetic v0.2.1 signed-asset fixture: generated and verified latest.json, including the exact canonical pickforge-ide asset URL
• bun run lint
• bun run build (tsc --noEmit and production Vite build)
• bun run test:unit (123 files, 1,648 tests)
• bun run test:coverage (thresholds passed)
• bun run e2e (device-free suite passed)
• bun run vrt (86 tests)
• bun run sidecar
• cargo check -p pickforge-tauri --locked
• cargo test --workspace --locked --all-targets
• cargo clippy --workspace --all-targets -- -D warnings
• JSON and release-workflow YAML parsing

Not verified

• No release bundle was built and nothing was signed, tagged, published, renamed, archived, or deployed.
• The real signed v0.2.0 → v0.2.1 updater flow remains an owner release step.
• Platform installer launch/install checks remain release-workflow and owner steps.
• The serial-backed Android E2E was skipped because PICKFORGE_E2E_SERIAL was unset.

CI fixes carried on this branch

main has been red since 2026-09-02 (run 33671230007) and this PR inherited both failures. The v0.2.1 release must be cut from a green branch, so the fixes ride here as two separate commits after the retirement work. Neither touches the retirement change or any version.

dependency audit — the OSV gate blocked five high-severity npm advisories, all reached transitively:

Advisory	Package	Reached via	Fixed in
GHSA-rgw5-rvv9-x895	brace-expansion 5.0.8	minimatch	5.0.9
GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx	browserslist 4.28.2	@babel/helper-compilation-targets	4.28.7
GHSA-2v37-7h3g-55p8	nanoid 3.3.16	postcss	3.3.18
GHSA-4cwx-7wf7-3272	undici 7.28.0	jsdom	7.29.0

Each is floored with a package.json override on the same major line, the way postcss was handled in #283. No audit exceptions were added. Every direct dependency keeps its declared range; the only other lockfile movement is browserslist's own dependency floors (baseline-browser-mapping, caniuse-lite, electron-to-chromium, node-releases, update-browserslist-db), which the 4.28.8 resolution requires.

cargo + tsc + build — the runner's dtolnay/rust-toolchain@stable moved from 1.96 to 1.98 and two clippy lints now fire under -D warnings. The repo pins no toolchain, so the code was fixed rather than the toolchain pinned:

• chunks_exact_to_as_chunks in crates/pickforge-core/src/voice/segments.rs, on the wav sample decoder's fixed two-byte frames. as_chunks::<2>() hands &[u8; 2] straight to i16::from_le_bytes.
• result_large_err in src-tauri/src/{ios,logcat,mirror}_commands.rs, on each session manager's replace_session, whose Err variant hands the caller its session back so it can be stopped. That variant is now boxed; the handover is unchanged. This one was hidden behind the first: cargo never checked pickforge-tauri while pickforge-core was failing.

Behaviour is unchanged in both cases. clippy 1.96 was already clean on this tree, confirming the drift.

How the CI fixes were verified

Locally, with the same commands and the same tool versions CI uses:

• node --test tests/check-osv-severity.test.mjs — 8/8 pass
• osv-scanner-action:v2.3.8 container over a clean tree of tracked files with the CI scan args, then node scripts/check-osv-severity.mjs osv-results.json Cargo.lock bun.lock — 19 advisories, 0 blocking; scanned 2 lockfiles (was 28 advisories, 5 blocking)
• bun install --frozen-lockfile — no changes
• bun run test:installer, bun run lint, bun run build, bun run test:unit (123 files, 1,648 tests) — all pass
• Rust 1.98.1 installed alongside the local 1.96 to reproduce the runner: cargo +1.98.1 check --workspace --locked, cargo +1.98.1 test --workspace --locked --all-targets (982 tests, 0 failed), cargo +1.98.1 clippy --workspace --all-targets -- -D warnings — all clean

Runbook summary

After merge, Elberte verifies the existing Actions signing secret names, creates and pushes the same annotated tag style used for v0.2.0, waits for the signed draft, verifies its manifest/assets, publishes v0.2.1, and tests an installed v0.2.0 if available. Only then does the runbook rename the repo, regenerate the manifest with canonical post-rename asset URLs, verify every URL, archive the repo, and hand the final URLs to the landing-page pivot PR. It also gives containment and manual v0.2.1 recovery steps if a legacy install ever fetches a successor manifest.