fix: secure release and repair marketplace bootstrap

[Alex Power[s] BI (itsnotaboutthecell)]

Description

Fix the release blockers found while preparing SQL Apps 0.2.3 for marketplace submission:

• Update only the compatible locked Tedious dependency from 20.3.5 to 20.3.6, whose upstream fix removes sprintf-js. This addresses Dependabot alert 1 / CVE-2026-97058 without dismissing it.
• Load TypeScript only for application AST inspection, keeping creation helpers and design-evidence validation usable before dependency restoration.
• Move the compiled endpoint CLI regression into the post-build test suite rather than requiring build output in the dependency-free CI job.
• Synchronize the slow-endpoint fixture and wait for completed observations before asserting cache freshness, preserving progressive endpoint checks and stale-state coverage.
• Honor an explicitly selected foundation for project creation from a remote plugin installation and document marketplace installation separately from npm package availability.

The version remains 0.2.3. No npm package publication, cloud deployment, or manual alert dismissal is included.

Validation

• npm test - passed: 520 foundation tests and 32 example tests; 2 Windows symlink tests skipped because the OS denies symlink creation.
• npm run typecheck - passed.
• npm run plugin:check - passed.
• npm run tooling:check - passed.
• npm audit --omit=dev - passed: 0 vulnerabilities.
• npm ls tedious sprintf-js - passed: Tedious 20.3.6 is shared by the production driver and type package; no sprintf-js.
• git diff --check - passed.
• Follow-up for the macOS CI failure: canonicalized temporary consent fixture homes so /var aliases do not bypass the ESM entrypoint guard. node --test tests\local-consent.test.mjs passed all 34 tests after that change.
• Follow-up for Windows Node 24: canonicalized the project fixture's user home before comparing the physical project identity, avoiding an 8.3 temporary-path alias mismatch. node --test tests\projects.test.mjs passed all 17 tests after that change.
• The following dependency-free CI command was run in an isolated tracked-files snapshot containing neither node_modules nor dist: passed, 148 tests and 1 Windows symlink skip.

$creation = @(Get-ChildItem -LiteralPath tests -Filter 'creation-*.test.mjs' | ForEach-Object FullName)
node --test @creation tests\setup.test.mjs tests\setup-install.test.mjs tests\setup-journey.test.mjs tests\local-consent.test.mjs tests\workspace.test.mjs tests\workspace-runtime.test.mjs

• In an isolated COPILOT_HOME, copilot plugin marketplace add microsoft/sql-apps, copilot plugin install sql-apps@sql-apps-skills, copilot plugin list --json, and copilot skill list --json passed: the current remote 0.2.3 plugin is enabled and all six skills are discovered. This verifies distribution, not the unmerged routing fix or complete application restoration.
• npm view @microsoft/sql-apps@0.2.3 version --fetch-retries=0 --fetch-timeout=15000 - blocked: the configured public feed returns E404. Clean-feed application installation is not claimed.
• npm run sql:build, npm run infra:build, npm run dab:validate, live SQL integration, and live Azure acceptance were not run locally; remote CI must provide its own results.
• Final-head npm test rerun - passed again: 520 foundation tests plus 32 example tests, 2 Windows symlink skips.
• gh run watch 39085703899 --repo microsoft/sql-apps --exit-status --interval 30 - passed. Final remote CI is green across all seven jobs: dependency-free setup diagnostics on Ubuntu/Windows/macOS, and full validation on Ubuntu/Windows with Node 22 and 24, including the workflow's type, DAB, SQL-project, application-model, and infrastructure checks. This is CI validation, not live SQL/Azure acceptance.

Remaining release prerequisites

The authenticated contributor currently has read-only upstream code access (push: false), so a direct push to main was rejected with HTTP 403. Remote CI is verified green; a maintainer must merge this PR.

An authorized package owner must publish @microsoft/sql-apps@0.2.3 and verify a clean configured-feed restoration before the marketplace submission is ready. The package must be built and checked using the repository's tooling-package commands; the root publish script is application deployment, not npm package publication.

Type of change

• Bug fix
• New feature
• Documentation update
• Other

Checklist

• I have read the Contributing Guide
• My changes follow the existing code style
• I have tested my changes locally
• I have updated documentation as needed

AI disclosure

An AI assistant using Copilot SDK in VS Code investigated the dependency and CI failures, implemented focused fixes and regression tests, executed the validation above, and prepared this PR. Maintainer review and external release prerequisites remain required.