release: 0.1.7 (array frameworkManifest normalizer)

[qmarcelle]

Cuts 0.1.7, carrying the array frameworkManifest normalizer from #10.

Why this branch exists

#10 (e0827a8) landed on main and has been sitting unpublished. The
branch that looked like the release lane, polish/extension-marketplace-metadata,
carries a release: bump to 0.1.6 commit but does not contain e0827a8 —
it still has the old guard at src/services/workspace.ts:150. Cutting 0.1.7
from there would have shipped a release without the fix it exists to deliver,
with a fully green board attesting otherwise. This branch is cut from main.

Commits

• 940d394 — version bump across the three sync points (package.json,
  package-lock.json, runtime VERSION in src/index.ts), matching the
  shape of the 0.1.6 bump.
• c165393 — gitignore local editor state. .vscode/ was failing
  check:structure, the first gate in prepublishOnly. Needs both a
  .gitignore entry and a biome.json ignore entry, matching the existing
  .claude / .local convention.
• 62bbddf — CI assertion that the normalizer is in the shipped tarball.

The acceptance-test problem this fixes (HAC-206)

The verification step for this fix could not detect it. Billfold's artifact
carries frameworkManifest: [], and an empty array normalizes to
undefined with or without the fix — normalizeFrameworkManifest returns
undefined when the manifest ends up empty, deliberately, because no
detected frameworks means no framework context. Measured through the
0.1.7 build:

input	result
[] (billfold's artifact)	undefined
[{name:"express",version:"4.19.2"}]	{"express":"4.19.2"}

So the check returned the same "correct" answer in both directions and
discriminated nothing. Confirmed the fix's absence from 0.1.6 the
discriminating way instead — by unpacking the published tarball, which
contains zero occurrences of normalizeFrameworkManifest and still carries
the old frameworkRaw guard.

62bbddf promotes that tarball check into CI. Verified to discriminate:
published 0.1.6 fails it, a 0.1.7 pack passes it.

Known limit: it asserts a symbol name, so it catches the fix going missing,
not the fix being wrong. A behavioural gate needs a non-empty
frameworkManifest fixture — that is the follow-up, not this PR.

Scope

Normalizer only. The extension stays at 0.1.2 and releases on its own
extension-v* tag, so the walkthrough assets cannot ride this train.

Verification

• Full npm run check green in a pristine clone and on the release branch;
  smoke reports v0.1.7 ready on stdio.
• e0827a8 confirmed an ancestor; old frameworkRaw guard absent.

Release

Merge, then tag the merge commit codex-mcp-v0.1.7 and push the tag —
publish-npm.yml does the rest.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.