[codex] Resolve source alpha readiness items

[Junnyyy]

TL;DR

Resolved the source/demo alpha release-readiness docs cleanup and the moderate module-federation tooling audit finding without adding npm publishing or release automation.

What changed?

• Clarified root and package docs so package install snippets are future/when-published guidance for the current source/demo alpha
• Removed stale README non-goal wording that said Latch does not include CI, while preserving that CI is quality gates only and not deployment or npm publishing
• Bumped the module federation demo apps from @module-federation/vite 1.16.2 to 1.16.4
• Updated the lockfile so @module-federation/dts-plugin resolves to 2.5.1 and ws resolves to patched 8.21.0
• Recorded the durable module-federation audit/TypeScript peer learning in AGENTS.md

How to test?

1. CI=true pnpm install --frozen-lockfile
2. pnpm build
3. pnpm test
4. pnpm typecheck
5. pnpm lint
6. pnpm latch report --flags packages/cli/examples/flags.json --src "packages/cli/examples/src/**/*.{ts,tsx}" packages/cli/examples/fixtures/flags.dev.json
7. pnpm audit --audit-level high
8. pnpm audit

Why make this change?

This keeps the public source/demo alpha posture honest: docs no longer imply packages are already available on npm, the root README no longer contradicts the checked-in CI workflow, and the module-federation demo no longer carries the moderate ws advisory. The fix uses an upstream patch-level tooling bump rather than weakening pnpm strict peer handling, changing the TypeScript 6 setup, replacing module federation tooling, or accepting a residual demo-tooling vulnerability.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

---

Note

Low Risk
Documentation-only messaging plus devDependency patch bumps in demo apps; no runtime SDK or auth/data-path changes.

Overview
Clarifies source/demo alpha posture in root and package READMEs: workspace clone/pnpm install is the supported path, pnpm add snippets are future published-package guidance, and there is no npm publishing workflow. Root non-goals and CLI docs no longer claim Latch lacks CI; they state checked-in CI is quality gates only (including pnpm latch report), not deploy or publish automation.

Bumps @module-federation/vite 1.16.2 → 1.16.4 in all three MF demo apps and refreshes the lockfile so DTS tooling pulls @module-federation/dts-plugin 2.5.1 and ws 8.21.0, addressing the moderate ws audit via upstream tooling. AGENTS.md records that fix and that TypeScript 6 peerDependencyRules.allowedVersions should stay until the DTS plugin peer range widens.

^{Reviewed by Cursor Bugbot for commit 84125a5. Bugbot is set up for automated code reviews on this repo. Configure here.}