fix: return bounded complete profile reads

[andrei-hasna]

Summary

• add a producer-bounded profile page contract with explicit total/cursor/completeness metadata
• make profile membership reads source-bounded and page-complete for exact readback
• resolve machine profiles by scanning bounded source batches to exhaustion without materializing the whole profile set
• preserve whole-array store methods as compatibility aggregators and preserve PR fix(profiles): remove retired project channel prefix #59 profile-update behavior

Bug and blocked activation

• Bug task: 898b3895-1f61-4e77-8c52-be28493f1d4a
• Parent rollout task: 54ea58f4-f841-4575-a37f-9498ce3b5d2f
• Blocking config: 582337eb-f882-4c6e-9206-4979c290eae7
• Station: station02

Regression-first evidence

Before the implementation, src/cli/profile-reads.test.ts failed all three cases: list JSON returned all six profiles despite --limit 2, while show/resolve lacked the required JSON read surface (0 pass, 3 fail, exit 1).

After the implementation:

• focused: 39 pass, 0 fail, exit 0
• full: 613 pass, 0 fail, exit 0
• typecheck: exit 0
• build: exit 0
• staged gitleaks: no leaks found, exit 0
• committed-head gitleaks: 1 commits scanned, no leaks found, exit 0

The repository package-manager guard also ran and reported 11 pre-existing untracked home findings in ~/.bunfig.toml and ~/.npmrc; it did not inspect or print values and is unrelated to this staged diff.

Overlap analysis

PR #59 was already squash-merged as base commit 361c3e94b746609cc9d7ff0fc86bed77c1b1d2ea. This PR keeps its profile-update behavior and changes only new bounded-read hunks plus the necessary test parser adaptation; no active overlap remains.

Scope

No merge, publish, install, profile mutation, or rollout is included. The parent coordinator will supply the fixed independent adversarial review against this exact head.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

Remediation cycle 1 is ready for focused re-review at exact head ec5d37b2d135a136012b0d5def720452376951e3.

Only the two named P1 blockers and direct regressions changed:

1. Mixed-version /v1 compatibility
   • no-query legacy list/show responses remain complete and never silently truncate at 20;
   • new clients always send explicit bounds;
   • new clients safely adapt historically complete old-server arrays and old resolver/404 responses;
   • compatibility fallbacks are labeled source_bounded: false and do not invent scan counts.
2. OpenAPI/generated SDK
   • bounded list, show membership, and resolve schemas are documented;
   • sdk/src/v1.generated.ts was regenerated and exposes bounded list/show/resolve methods and nullable cursor/legacy-count fields.

Regression-first evidence: pre-fix 22 pass / 8 fail / exit 1; post-fix focused 47 pass / 0 fail / exit 0.

Additional gates:

• full tests: 621 pass / 0 fail / exit 0
• root typecheck: exit 0
• SDK typecheck: exit 0
• SDK regeneration hash stable: exit 0
• build: exit 0
• staged and committed-head gitleaks: no leaks found, exit 0

The non-blocking MCP and package-home items were not changed. No merge, publish, install, profile apply, or rollout was performed.