chore(release): instructions 0.4.25

[andrei-hasna]

Summary

• Bump @hasna/instructions from 0.4.24 to 0.4.25.
• Add CHANGELOG.md entry for already-merged main commits 9fe30cc (fix: update conversations send workflow contract #74) and f3784d3 (fix(session): bound managed source admission #76).
• Regenerate sdk/src/v1.generated.ts so its OpenAPI source marker is 0.4.25.

Task: a2343e0d-5423-4295-ad1a-d3af6da00f26

Scope

Release metadata/generated artifacts only. No product/workflow changes, no publish, no install, no render, no Instructions profile mutation.

Base: f3784d3
Head: ff7df93

Gates run

• npm view @hasna/instructions version: 0.4.24
• git rev-parse HEAD before edit: f3784d3e5f4e7a28389c91e42c127a93c6628a32
• npm gitHead: b9f6ed9cc851173ecafe686675e94f84ca1f92c3; published is ON main; reverse range origin/main..published empty
• bun install --frozen-lockfile: exited 0
• bun run scripts/check-publish-hold.ts: exited 0 with empty stdout
• bun run generate:sdk: Wrote .../sdk/src/v1.generated.ts
• bun run kit:check: ok storage-kit check (expected v0.4.2)
• bun run typecheck: tsc --noEmit exited 0
• bun run test: 638 pass, 0 fail
• bun run build: exited 0
• dashboard bun install --frozen-lockfile: exited 0; no tracked file changes
• bun run build:dashboard: ✓ built in 503ms
• bun pm pack --dry-run: hasna-instructions-0.4.25.tgz; Total files: 227; Unpacked size: 3.1MB
• bun run prepublishOnly: exited 0
• bun run src/cli/index.tsx package-manager-scan --fail-on-findings .: ✓ Package-manager scan clean (2 file(s)).
• configured pre-commit hook on staged files: exited 0 with empty stdout
• secrets scan workspace . --pretty: exited 0, reported pre-existing synthetic/test fixture findings outside the staged release files
• git push pre-push hook: [pre-push] scanning 1 commit(s) for refs/heads/a2343e0d-release-0.4.25

Known non-diff gate note

bun run check:package-secrets exits 1 because its --home flag scans the real machine home and reports pre-existing untracked ~/.bunfig.toml broad-exclude entries. The in-scope repo package-manager scan is clean, and none of those findings is in this PR diff.

Review

Independent reviewer still required by the task. I did not self-review as a substitute.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — exact head ff7df93; exact head/landing tree 6d5eea6b5dc294d916195a03e88d730898b04bde.

Acceptance evidence:

• The diff is limited to CHANGELOG.md, package.json, and sdk/src/v1.generated.ts. Normalizing away the version leaves package.json and the generated SDK byte-identical to the base; an independent in-memory SDK regeneration matched the checked-in file exactly.
• npm 0.4.24 records gitHead b9f6ed9. Exactly two commits follow it on main: 9fe30cc (fix: update conversations send workflow contract #74) and f3784d3 (fix(session): bound managed source admission #76), and the changelog accurately describes both.
• GitHub Actions run 31256060826 is success on this exact head. ubuntu-latest and macos-latest each passed install, package-manager secret guard, typecheck, 638 tests with 0 failures, and build.
• The release task evidence for generate:sdk, kit:check, dashboard build, pack dry-run, prepublishOnly, staged hook, and pre-push hook is consistent with the clean exact-head tree. The local real-home package scan finding is pre-existing and outside the three-file release diff; the required CI package-manager guard passed on both platforms.
• Registry latest remains 0.4.24, 0.4.25 is absent, and 0.4.24 retains published integrity/shasum evidence as the rollback artifact.

No concrete evidence-backed reachable in-scope P0/P1 defect was found in release correctness, secrets/security, package integrity, install/runtime compatibility, or rollback viability. P2/P3 and the pre-existing home-scan finding are non-blocking.