Use latest SDK tooling for regeneration

[calvin-archastro]

What Changed

This keeps the Python SDK regeneration automation on the latest published ArchAstro tooling packages instead of pinning stale package specs in package.json.

• @archastro/sdk-generator now uses the npm latest dist-tag in package.json and resolves to 0.3.2 in package-lock.json.
• @archastro/channel-harness now uses the npm latest dist-tag in package.json and resolves to 0.1.2 in package-lock.json.
• The manual Regenerate SDK workflow now refreshes both packages from latest, then commits package.json and package-lock.json into the generated PR with the SDK output.

No generated SDK/spec files are included in this PR.

Diagrams

This is a CI config and dependency-lock update only. It does not add or change runtime/control flow in the SDK and does not add or restructure application types, so there is no meaningful sequence or class diagram to render.

Scope

Tooling and CI only.

Risk Assessment

Low to medium. The change is limited to regeneration tooling, but future manual regeneration runs will intentionally resolve the latest published ArchAstro generator and harness before creating the SDK update PR. The generated PR still records the exact resolved tarballs and integrity hashes in package-lock.json for review and repeatable CI installs.

User Impact

No direct SDK runtime impact in this PR. The next regeneration run will use the latest generator package by default, which is needed for the Python keyword-handling fixes published in @archastro/sdk-generator@0.3.2.

Testing

• npm ci --ignore-scripts --registry=https://registry.npmjs.org --@archastro:registry=https://registry.npmjs.org
  • resolved successfully
  • audited 197 packages
  • found 0 vulnerabilities
• npm audit --audit-level=moderate
  • found 0 vulnerabilities
• Resolved direct tooling versions from node_modules:
  • @archastro/sdk-generator@0.3.2
  • @archastro/channel-harness@0.1.2
• Workflow YAML parse passed with Ruby YAML.load_file
• git diff --check HEAD~1 HEAD passed

Follow-ups and Known Issues

Run the manual Regenerate SDK workflow after this merges to generate the actual SDK/spec changes with @archastro/sdk-generator@0.3.2.

[archastro]

✅ Clean PR, @calvin-archastro! No blocking findings on 0b6dada — a few nice things I clocked:

• Preserved the supply-chain guards across the latest switch — --ignore-scripts on every npm install plus the npm audit --audit-level=moderate gate both intact in regenerate-sdk.yml. 🎯
• Nice follow-through extending the detect-changes, git add, and PR-body file_count steps to include package.json package-lock.json so the regenerated lock travels with the SDK output in one reviewable PR.
• Kept the generator-version resolution honest by reading it from the installed node_modules/@archastro/sdk-generator/package.json rather than the floating spec — the PR body's version label stays accurate per run.

---

_{Reply @archastro <verb>: review · do <pattern> · don't <pattern> · forget <slug> · list}