chore(release): prepare instructions 0.4.24

[andrei-hasna]

chore(release): prepare instructions 0.4.24

Carries 0fcb0542 (#72): planSessionRender refuses to emit a managed output larger than the bound the reader will later accept, and warns at half of it. 0.4.23 raised the READ bound to SESSION_MANAGED_OUTPUT_MAX_BYTES (8 MiB) and left the WRITE unbounded, so the two sides agreed by headroom rather than by a check.

Diff is package.json 0.4.23 -> 0.4.24 plus a CHANGELOG entry. No logic.

The defect this releases a fix for, reproduced on the INSTALLED 0.4.23 before bumping

Scratch target home only, --target-home under a temp dir; no live instruction home was read, rendered, or written at any point.

instructions session apply --tool codex --profile scratchprobe --target-home <scratch> --source global:big=<9,090,014 byte md>
  -> rc=0, no stderr
  -> emitted AGENTS.md = 9,090,417 bytes   (bound 8,388,608)

instructions session plan  --tool codex --profile scratchprobe --target-home <same scratch home> --source global:small=<28 byte md>
  -> rc=1
  -> PROJECT_CONTEXT_INPUT_TOO_LARGE: managed input exceeds 8388608 bytes

The second command is a render that would have SHRUNK the home back under the bound, and it is refused. That is the wedge: the writer emits a file the reader will not open, and planning reads the oversized file before it can decide to replace it.

--tool claude does not reproduce it, correctly — claude is a splitting adapter, so the payload lands in .hasna/instructions/01-big.md and CLAUDE.md stays an index. codex is the flattening adapter and is the one that wedges, which matches the #72 analysis.

Release gates exercised on this branch before the tag

gate	result
npm view @hasna/instructions@0.4.24 version	rc=1 E404, version free. Control: @0.4.23 rc=0 -> 0.4.23
bun install --frozen-lockfile --minimum-release-age 604800	rc=0, 158 packages, bun.lock UNCHANGED afterwards
bun run typecheck	rc=0
bun run test	rc=0, 632 pass 0 fail, 2643 expect() calls, 54 files
bun run build	rc=0, 4 bundles
guard test file alone	rc=0, 5 pass 0 fail, 18 expect() calls
guard string in BUILT dist/cli/index.js	1 occurrence. Control: an impossible string -> 0
staged secrets scan	0 hits, rc=1. Control: version -> 3 matches, so the grep was live

The lockfile check mattered again: bun.lock's root workspace block carries name and no version key, so the bump cannot desync --frozen-lockfile. That gate runs AFTER the tag is pushed, which is the expensive place to discover it.

Base resolved from the branch, not from the PR object: origin/main = 0fcb0542; git merge-tree --write-tree produced 70d6daed, identical to this branch's head tree, so the merge result is what was verified.

Review decision, recorded rather than silent

This mechanical release PR was NOT sent to an independent adversarial reviewer, and that is a decision rather than an omission. The substance was independently reviewed and returned GO on #72 by reviewer Priscus at ab82cbb9, with falsifiability demonstrated rather than asserted (refusal call removed: 2 pass 3 fail with DID NOT THROW on the three refusal arms, both negative controls still passing; at head 5 pass 0 fail), and the reviewer additionally fired the manifest arm the author had recorded as unfirable. This PR adds no logic to review. Whether mechanical release PRs need their own review pass is an open fleet question nobody has ruled on; a silent skip and a reasoned one look identical afterwards, so this is the reasoned one.

Known residual, not fixed here

OPE15-00068: a home that is ALREADY oversized stays unrecoverable through this tool, because planning reads it before it can replace it. Reproduced above as the second command. This release prevents new wedges; it does not cure an existing one.

Row: OPE15-00066.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}