toolkit merge: pre-rename validation, rename, release cutover

[BYK]

Sub-task of the toolkit monorepo merge: #1248.

Pre-rename validation in getsentry/sentry-mcp

• Imported CLI and docs before the rename via Toolkit #1320 (toolkit merge: import CLI into sentry-mcp, validate, then rename #1239).
• Full pnpm build, typecheck, lint, test:unit, test:e2e, MCP evals/smoke, CLI binary smoke on all platforms, and docs preview pass.
• Workspace Publish dry-runs pass for CLI and MCP.
• Prefixed Craft workspace dry-runs pass for CLI and MCP with no cross-product tag/changelog/version contamination.
• Existing MCP Cloudflare Worker deploy canary passes after Turbo removal.
• Confirm the release-gated Vercel CLI-docs preview from apps/cli-docs, with https://cli.sentry.dev/install unchanged.
• Exact-head import CI and Warden correctness/security reviews passed on Toolkit #1320.

Rename and post-rename validation

• Renamed the imported repository to getsentry/toolkit, retaining repository ID 957245447 (Validate merged monorepo in sentry-mcp, then rename to getsentry/toolkit toolkit#1156).
• Verify redirects, settings, secrets, environments, GitHub App, webhooks, branch protections, and Cloudflare wiring.
• Reran required CI and verified the protected exact-version production Worker after Toolkit #1399 and #1400.
• Published Toolkit CLI stable 0.46.0 and 0.47.0.
• Verified the MCP Worker continuously deploys from tested main through the protected exact-version workflow (feat(docs): add Vercel analytics and speed insights #1399, docs: weekly documentation audit — fix Zod→Valibot drift, stale versions, dataset list #1400); a prefixed MCP GitHub release is not required for Worker deployment. Keep stdio npm publishing as a separate concern.
• Verified the published Linux x64 legacy 0.44.1 -> bridge 0.45.0 -> Toolkit stable 0.47.0 -> Toolkit nightly -> stable path (evidence).
• Reconcile the remaining non-Linux, package-manager/Homebrew, and source-failure cases from toolkit merge: bridge CLI release + dual-source upgrade compatibility #1244 before treating the full compatibility matrix as complete.

Cutover

• Verified CLI stable 0.47.0 and Toolkit GHCR nightlies, the live stable/nightly installer, Linux x64 upgrade chain, and npm package tests on Node 20/22/24 (evidence).
• Complete any remaining supported platform/install-method validation before ending legacy publishing; leave existing bridge release assets publicly readable.
• Announce Toolkit as the canonical repository.
• Keep getsentry/cli writable and its releases/GHCR live throughout the compatibility window.
• After the dedicated migration of open PRs/issues and the distribution/upgrade cutover pass, archive getsentry/cli promptly with a README redirect; no fixed waiting period.

The old CLI repository must never be archived before PR/issue migration and cutover verification finish.

[BYK]

Master tracking issue: #1248

[BYK]

Cutover verification (2026-10-05; isolated Linux x64 home, config, cache, and install directories):

• Published legacy 0.44.1 upgraded through the legacy endpoint to bridge 0.45.0 in its actual ~/.sentry/bin location. The installed bridge SHA-256 matched its GitHub release asset (658363afd0c6d581b887de41160c40adc7e29c79c015569a57aaf01532ed47be). Pre-bridge users need this first upgrade; a second upgrade from bridge 0.45.0 reached Toolkit 0.47.0 directly. The installed 0.47.0 SHA-256 matched the Toolkit release asset (ce2e2e9a0324bd66e2413a03410e765f4c6c1d15503c3380639849611051d4ff). A separate 0.45.0 → 0.46.0 → nightly → stable chain also passed.
• Toolkit CLI 0.47.0 was built from exact candidate 56447ac00a004c2f57ef360aaad967d1b5f511c3: Build passed five binary builds, packaged npm tests on Node 20/22/24, and docs packaging. Publish #9766 closed with accepted and ci-ready; npm executes sentry@0.47.0 successfully.
• Live https://cli.sentry.dev/install is HTTP 200 and matches the candidate Vercel artifact and merged installer byte-for-byte (SHA-256 8ed39815facf69a88153d1c6cd28e3cf606cb90c231d5b4c21d6beb3dc70227f). In isolated runs it installed stable 0.47.0 from Toolkit, Toolkit GHCR nightly, and pinned legacy 0.45.0 through exact-tag Toolkit 404 fallback. After release, 0.47.0 switched to Toolkit nightly 0.48.0-dev.1791208305; a bare upgrade check retained nightly, and upgrade stable returned to 0.47.0 with the published binary hash.

The live stable/nightly installer and tested upgrade paths no longer need new legacy releases. Keep existing legacy releases and GHCR publicly readable for old clients; finish the separate open-PR/issue migration before archiving the legacy repository with its README redirect. No fixed two-release or 90-day wait applies. End-to-end upgrade testing here covered Linux x64; CI built all five platform binaries, but other platforms were not tested end to end. The requested release-gated Cloudflare CLI-docs hosting move is separate from this legacy-repository gate; the live installer is currently served by Vercel.