fix: address third-pass review (stale workflow comments + missing test)

release.yml:
- The header comment block and dry_run input description still referenced
  the PR-and-merge step that was removed in 53c2e45. Updated both to
  describe the direct-commit flow.

runtime.test.ts:
- The runtime resolver's npm-package branch (step 2 — the primary path
  after npx kandev@latest or npm install -g) had no positive coverage. In
  the test env, require.resolve for @kdlbs/runtime-* throws
  MODULE_NOT_FOUND, so the existing tests only exercised step 1 (env var)
  and step 3 (cache via --runtime-version), plus the no-runtime-found
  fallthrough.

  Added two tests using vi.spyOn on Module._resolveFilename to point at a
  fake bundle inside tmpDir:
    - happy path: installed npm package resolves to source=npm with the
      right bundleDir
    - corrupt-bundle path: validateBundle errors propagate (rather than
      being swallowed and falling through to "no runtime found")

  These cover the real-world scenarios users will hit on either install
  channel.

Tests: 132 → 134.

.github/workflows/release.yml

@@ -4,7 +4,7 @@ name: release
 # Trigger: GitHub Actions UI → "Run workflow" (workflow_dispatch).
 #
 # Flow (one click → everything below):
-#   1. prepare        — bump version, regen CHANGELOG, open + merge release PR, push tag vX.Y.Z
+#   1. prepare        — bump version, regen CHANGELOG, commit to main, push tag vX.Y.Z
 #   2. build-web      — build Next.js standalone bundle
 #   3. build-cli      — build + esbuild-bundle CLI
 #   4. build-bundles  — assemble bin/ + web/ + cli/ tarballs for 5 platforms
@@ -33,7 +33,7 @@ on:
           - minor
           - major
       dry_run:
-        description: "Dry run (no PR, tag, npm publish, or tap update)"
+        description: "Dry run (no commit, tag, npm publish, or tap update)"
         type: boolean
         default: false
 

apps/cli/src/runtime.test.ts

@@ -1,4 +1,5 @@
 import fs from "node:fs";
+import Module from "node:module";
 import os from "node:os";
 import path from "node:path";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
@@ -116,6 +117,43 @@ describe("resolveRuntime", () => {
     });
   });
 
+  describe("installed npm runtime package (step 2)", () => {
+    // Step 2 normally relies on require.resolve('@kdlbs/runtime-darwin-arm64')
+    // succeeding because the npm package is installed alongside the kandev
+    // package. In this test environment that package isn't present, so we
+    // intercept Node's module resolver to point at a fake bundle inside tmpDir.
+    function mockResolve(target: string): void {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const ModuleAny = Module as unknown as { _resolveFilename: any };
+      vi.spyOn(ModuleAny, "_resolveFilename").mockImplementationOnce(() => target);
+    }
+
+    it("resolves from the installed npm runtime package", () => {
+      const pkgRoot = path.join(tmpDir, "npm-runtime");
+      createFakeBundle(pkgRoot);
+      // require.resolve('<pkg>/package.json') normally returns the path to the
+      // package.json inside node_modules. Point it at our fake bundle instead.
+      const pkgJsonPath = path.join(pkgRoot, "package.json");
+      fs.writeFileSync(pkgJsonPath, "{}");
+      mockResolve(pkgJsonPath);
+
+      const result = resolveRuntime();
+      expect(result.source).toBe("npm");
+      expect(result.bundleDir).toBe(pkgRoot);
+    });
+
+    it("surfaces validateBundle errors when the npm package is installed but corrupt", () => {
+      const pkgRoot = path.join(tmpDir, "broken-npm-runtime");
+      fs.mkdirSync(pkgRoot);
+      // package.json present (so require.resolve succeeds), but no bin/ or web/
+      const pkgJsonPath = path.join(pkgRoot, "package.json");
+      fs.writeFileSync(pkgJsonPath, "{}");
+      mockResolve(pkgJsonPath);
+
+      expect(() => resolveRuntime()).toThrow(/Backend binary not found/);
+    });
+  });
+
   describe("cache fallback (step 3 — runtimeVersion only)", () => {
     it("resolves from cache when runtimeVersion is given and cache exists", () => {
       const tag = "v0.16.0";