docs: pin the README CDN snippets, and make the release own them

[adnaan]

README.md advertised @livetemplate/client@0.1.0 in both CDN snippets while the package was on 0.20.0 — nineteen minor versions of drift.

That is not only a stale README. The docs site mirrors this file verbatim to /client/, so every reader there was told to load a bundle from long before the current wire format, against a server that would not speak it. There is no runtime handshake between server and client, so the failure mode is a silently broken app rather than a version warning.

Why the bump alone is not the fix

Nothing in the release path touched README.md. update_version_files() rewrote VERSION and package.json; the literal in the README was owned by nobody, so it was guaranteed to rot again on the next tag — exactly how it reached 0.1.0-vs-0.20.0 in the first place.

So the release owns it now:

• update_version_files() rewrites the pins alongside VERSION and package.json.
• README.md joins the list restored when a release aborts midway. Without that, a failed run leaves the tree dirty and the next attempt refuses to start — the same trap fix(release): run tests before mutating, restore files on abort #151 fixed for the other files.

The substitution is anchored to @livetemplate/client@<semver>, so the unpinned npm install @livetemplate/client line and any unrelated scoped package are untouched. Verified against a fixture covering all three cases before wiring it in:

@livetemplate/client@0.20.0/dist/...  ->  @livetemplate/client@0.21.0/dist/...   (rewritten)
npm install @livetemplate/client       ->  unchanged
@livetemplate/other@1.2.3              ->  unchanged

sed -i.bak rather than bare -i so it behaves identically on macOS.

Verification

npm test: 824 passed across 39 suites, 1 skipped. bash -n scripts/release.sh clean. Pre-commit (lint + full suite) green.

Found while auditing dead and stale links across the docs site (livetemplate/docs#130), which fixed 118 broken mirrored links but could not fix this one — the docs repo mirrors this README, so the correction has to happen here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QzC2djPjPHkNJgPzFpMX7v

[claude]

Review

What this does: Fixes the stale @livetemplate/client@0.1.0 CDN pins in README.md (should've been 0.20.0) and makes scripts/release.sh own keeping them current going forward — updates the pins in update_versions(), and adds README.md to the abort-restore list in restore_release_files().

Bug: the README update never gets committed

update_versions() (scripts/release.sh:210-216) rewrites README.md in place, but commit_and_tag() (scripts/release.sh:307) still only stages the original four files:

git add VERSION package.json package-lock.json CHANGELOG.md

README.md is missing from this list. On a successful release:

• release_committed is set to true after the commit, so restore_release_files() (trap on EXIT) takes its early-return path and does not revert the README.
• But the README change was never staged/committed either, since it's absent from git add.

Net effect: every successful release leaves README.md as an uncommitted, dirty modification in the worktree — the tag and commit go out with the old pin, and the fix has to be manually committed after the fact (or it's silently lost/reset before the next run). This defeats the stated goal of the PR ("the release owns it now") and reintroduces the exact drift-on-every-release problem the PR is trying to close, just one script step later.

Fix: add README.md to the git add in commit_and_tag(), guarded the same way the write is (git add with [ -f README.md ] check, or just add it unconditionally since it's tracked).

Minor

• No automated test exercises commit_and_tag/update_versions together, which is how this would have been caught — the PR description mentions a fixture that verified the sed substitution but not that the file actually ends up committed. Worth a lightweight release-script test (or at least a git status --porcelain assertion) if there's an existing harness for scripts/release.sh.
• The sed -i.bak + rm -f *.bak pattern and the anchored (@livetemplate/client@)[0-9]+\.[0-9]+\.[0-9]+ regex look correct and match the fixture cases described (pinned CDN URL rewritten, unpinned npm install line and unrelated scoped packages untouched).