fix(release): version self-report parity — 0.1.8 + prepublish gate

[andrei-hasna]

What

Release PR #25 bumped package.json only, so main and the published 0.1.7 artifact self-report 0.1.6 from gateway --version (the hand-maintained gatewayVersion constant in src/version.ts was never bumped). This PR:

• bumps src/version.ts and package.json together to 0.1.8
• adds tests/version-parity.test.ts — genuinely RED on unmodified main (0 pass / 1 fail, rc=1), green here
• gates prepublishOnly on scripts/verify-version-parity.mjs, so a skewed publish fails instead of shipping a lying artifact

Evidence

• Red on main aa9b683: 0 pass / 1 fail (0.1.6 vs 0.1.7)
• Green post-fix: 1 pass / 0 fail; full suite 260 pass / 1 skip / 0 fail; tsc --noEmit clean
• Gate two-sided, literal lines: VERSION_PARITY_FAILED: src/version.ts gatewayVersion=0.1.8 != package.json version=0.1.99 (rc=1) / version parity ok: 0.1.8 (rc=0)

Rows

• todos a403124e-fc9e-412c-92e5-6597fdea005b (BUG: main and published 0.1.7 self-report 0.1.6)
• Follow-on to fix(router): session affinity runs in every shipped routing mode #24 / todos 7dd67da6-9ede-483a-ac3f-acd21cecd7f5 — closes the installed-version-verify gap of the wave-2 capacity-cli-and-affinity lane (hasna-internal/platform#61)

After merge: publish 0.1.8, bun install -g @hasna/gateway, verify gateway --version reports 0.1.8.

Agent: agent-chief-planning

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #26 @ bb7a7b2 — lens: correctness+security+gates, reviewer Xenon (1 of 1)

What I ran:

• bun install — exit 0; setup only; 114 packages installed.
• bun run typecheck — exit 0; 0 TypeScript errors; the gate emits no per-test count.
• bun run test — exit 0; 260 pass, 1 skip, 0 fail, 1310 expect() calls; 261 tests across 23 files.
• bun run verify:version-parity — exit 0; focused release-gate check printed version parity ok: 0.1.8.
• git diff --check origin/main...HEAD — exit 0.

What I read:

• Confirmed HEAD bb7a7b26b9f9259b4151bb5317faae91379ce191 and fetched base aa9b6839df69ede6328323131c9bfa34bc0c3d47.
• Read the full origin/main...HEAD diff for package.json, scripts/verify-version-parity.mjs, src/version.ts, and tests/version-parity.test.ts.
• Read surrounding version consumers in the CLI, serve binary, HTTP health/version/readiness responses, MCP server metadata, package exports, and existing CLI/serve/MCP tests.
• Traced the publish path: the parity script resolves the repository from its own module URL, compares the manifest version with the single exported source constant, and runs before typecheck/build/test in prepublishOnly.

Blocking P0/P1 findings: none.

Non-blocking follow-ups: none.

Security assessment: no changed authentication, authorization, secret, data-integrity, or external-input path. The release gate fails closed when the version constant is absent or differs from package.json; the runtime version surfaces all consume the same updated constant.