chore(release): prepare instructions 0.4.22

[andrei-hasna]

Summary

• bump @hasna/instructions from 0.4.21 to the unpublished patch version 0.4.22
• add the focused changelog entry for the managed Bash-profile helper guard
• leave bun.lock unchanged because it contains no root package version

Release provenance

• base: exact current main at 8cc97a1ba012f13105c1ef76dac7fe376c384868
• npm current: @hasna/instructions@0.4.21, published from ancestor 36bcc103e7e7e18f59e2c51d3ff36b9833272883
• target check: @hasna/instructions@0.4.22 returns npm E404
• refs: issue BUG: instructions — managed bash profile calls missing local env helper #65; task cde9f87b-ff03-45d2-9882-4899f0ba1e8b

Validation

• bun install --frozen-lockfile --minimum-release-age 604800 — pass
• bun run typecheck — pass
• bun run build — pass
• bun test --max-concurrency=1 — 623 pass, 0 fail
• isolated default-concurrency failures — 13 pass, 0 fail across the two affected files
• npm pack --dry-run --json — pass; 218 entries, package version 0.4.22
• staged and exact-commit gitleaks scans — zero leaks
• repository package-manager scan — clean
• git diff --check — pass

The unbounded local bun test command reproduces a pre-existing shared-process.env
test-isolation race: 618 pass, 5 fail, while those five tests pass independently.
This release changes only version/changelog artifacts; hosted CI will exercise the
repository-standard unbounded test command on Linux and macOS.

Scope

Release preparation only. This PR does not merge, tag, publish, install, or roll out
the package.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #68 @ e9e543a — lens: correctness+security+gates, reviewer Timon (1 of 1)

Candidate read:

• Confirmed HEAD e9e543a and origin/main 8cc97a1.
• Read git log --oneline origin/main..HEAD, git diff origin/main...HEAD --stat, and the full diff.
• Read the full package.json and surrounding CHANGELOG.md, plus the claimed Bash-profile implementation and regression coverage in src/lib/sync.ts and src/lib/sync.test.ts.
• The PR itself changes only package.json 0.4.21 -> 0.4.22 and adds the 0.4.22 changelog entry.

Commands and gates:

• bun install — exit 0; setup only; 158 packages installed.
• bun run typecheck — exit 0; no diagnostics (pass/fail count not emitted).
• bun run test — exit 1; 618 pass, 5 fail, 623 total across 53 files, 2571 assertions.
• Diagnostic full-gate reruns with the Instructions API variables first unset and then explicitly empty also exited 1 with the same 618 pass / 5 fail result. These were diagnostics, not substitutes for the declared gate.

Blocking P0/P1 findings:

1. P1 — the repository's declared test gate is red on the exact candidate. The five reproducible failures are:

   • configs session CLI > deduplicates one semantic policy across config and identity-export transports
   • configs list output > defaults to compact paged output
   • configs list output > verbose output discloses expanded metadata only when requested
   • configs list output > json output remains full matching records
   • configs apply ownership output > CLI direct and profile dry-runs report owned instructions and preserve OpenCode settings

   Four failures show getDatabase rejecting an in-process local test path because both Instructions cloud configuration variables are visible; the session CLI case fails its add command with status 1. Clearing the parent command's values did not change the result, so this needs an owning test-isolation diagnosis rather than a reviewer-side environment workaround. A required gate failure blocks this release candidate.

Security/correctness findings in the two changed files:

• None beyond the blocking required-gate failure. The release metadata matches the claimed already-landed Bash-profile guard, and no credential or trust-boundary change is introduced by this diff.

Non-blocking follow-ups:

• None.

Disposition:

• Leave the PR open. Repair the test isolation so the unmodified declared command bun run test returns exit 0, then request focused re-review of this named gate defect and any direct regression from that fix.