Toolcraft 0.0.121 reports bundled tiny-http-mcp-server as 0.1.0 instead of 0.1.3

[kamilio]

Summary

The published toolcraft@0.0.121 tarball contains the HTTP adapter from #516, but its bundled tiny-http-mcp-server identity and composition.json entry report version 0.1.0 even though the corresponding public release is tiny-http-mcp-server@0.1.3.

Observed from the registry tarballs:

toolcraft@0.0.121 gitHead: 9984b82f3267092ee310b0c1ff6c69887a4ede76
tiny-http-mcp-server@0.1.3 gitHead: 05f5372387c301df0d44414c214cb5e0ec809cfc

Inside toolcraft@0.0.121:

node_modules/tiny-http-mcp-server/package.json -> 0.1.0
composition.json tiny-http-mcp-server entry -> 0.1.0

The HTTP implementation works, but consumers relying on Toolcraft's supported composition/license contract cannot identify the bundled transport as the released 0.1.3 version described in the release handoff.

Reproduction

npm pack toolcraft@0.0.121
mkdir unpacked
tar -xzf toolcraft-0.0.121.tgz -C unpacked
node -e 'console.log(require("./unpacked/package/node_modules/tiny-http-mcp-server/package.json").version)'
node -e 'console.log(require("./unpacked/package/composition.json").packages.find(p => p.name === "tiny-http-mcp-server"))'

Both report 0.1.0.

Expected

The Toolcraft release workflow should bundle the intended released HTTP transport version and generate composition.json from the release-versioned package metadata, so the bundled identity matches tiny-http-mcp-server@0.1.3 (or clearly document that the embedded build is intentionally a different version).

Acceptance criteria

• A Toolcraft registry tarball bundles the intended tiny HTTP release version.
• The bundled package metadata and composition.json agree.
• The version also agrees with the separately published registry release used by the Toolcraft release.
• Add a release regression comparing the bundled composition entry against the expected lockstep HTTP release version.

[kamilio]

Resolved by d1e4ea7. The Toolcraft release now waits for a tiny-http-mcp-server registry release containing the current workspace source, stamps that exact version before packing, and verifies both bundled package metadata and composition.json against it. Verified toolcraft@0.0.125 (gitHead d1e4ea7) bundles tiny-http-mcp-server@0.1.4 and reports 0.1.4 in composition.json. Release runs 28889453522, 28889455664, and 28889453707 all completed successfully.