fix(workspace): pin zip to 7.1.0 to avoid transitive typed-path nightly requirement

[BimaPangestu28]

Summary

zip 7.2.0+ (and all 8.x) introduced a transitive dependency on typed-path ^0.12. typed-path 0.12.x uses feature(wasip2) stdlib APIs that fail on stable Rust under wasm32-wasip2:

error[E0658]: use of unstable library feature `wasip2`
  --> typed-path-0.12.x/src/.../pathbuf.rs

This blocked greentic-biz/greentic-bundle-extensions#26 — bundle-standard's CI builds for wasm32-wasip2 on stable, and after pinning cards2pack-core / bundle-standard-core to the new 1.2.0-dev.25512130996 (which lands the cards2pack-core empty-routing fix from #95), the dep tree pulls typed-path and breaks the build.

Why zip 7.1.0

zip 7.1.0 is the most recent release before typed-path was introduced (zip 7.2.0 adds it). Released Jan 2026, 205k+ downloads, not yanked, still maintained. bundle-standard-core only uses minimal zip API:

API used	7.1 → 8.x compatibility
zip::ZipWriter::new(...)	unchanged
zip::write::FileOptions::<()>::default()	unchanged
.compression_method(zip::CompressionMethod::Deflated)	unchanged
start_file(name, options)	unchanged
write_all(bytes)	(std::io::Write — not zip API)
finish()	unchanged
zip::ZipArchive::new(cursor)	unchanged

Zero code change required in bundle-standard-core. Verified empirically.

Verification

Check	Result
cargo update -p zip --precise 7.1.0 removes typed-path	✅ "Removing typed-path v0.12.3"
cargo check -p bundle-standard-core --target wasm32-wasip2 (stable)	✅ clean
cargo test -p cards2pack-core (24 unit tests)	✅ all pass
cargo test -p cards2pack-core --test golden (11 snapshot tests)	✅ all pass
cargo fmt --all -- --check	✅ exit 0
cargo clippy --workspace --all-targets -- -D warnings	✅ exit 0
Full WASM build via cargo component build --target wasm32-wasip2 --release from bundle-standard	✅ Component artifact created

Downstream impact

After merge + dev-publish stamp:

1. New cards2pack-core and bundle-standard-core published with NO typed-path in dep tree
2. PR fix: scaffold only webchat-gui assets from provider packs #26 in greentic-bundle-extensions can re-pin to the new RUN_ID and drop the wasm32-wasip1 override — wasm32-wasip2 now builds cleanly on stable
3. PR greenticai/.github#169 (which added wasm-target-install input as a workaround) becomes superseded — close as no-longer-needed
4. Standard wasm32-wasip2 stays the org-wide CI default, no migration churn

Test plan

• Unit + integration + golden tests pass with new pin
• Full reference-extensions/bundle-standard WASM build succeeds for wasip2
• After dev-publish stamp: new pin in PR fix: scaffold only webchat-gui assets from provider packs #26, CI green with default wasip2
• After PR fix: scaffold only webchat-gui assets from provider packs #26 merge: bundle-standard 0.2.5 .gtxpack via release.yml
• After publish: greentic-designer bundled/manifest.json refresh

Future-proofing note

If we eventually want to upgrade to zip 8.x (e.g., for new features or security patches), the path is:

1. Wait for typed-path upstream to drop the feature(wasip2) requirement (issue chipsenkbeil/typed-path#57) — they intentionally added it, so this is a maintainer decision
2. Or migrate bundle-standard-core to a different ZIP crate
3. Or org-wide adopt nightly Rust toolchain (heavy)

For now, =7.1.0 pin is the smallest blast-radius fix that keeps every downstream consumer working without changes.