adopt the export-surface gate

[drewstone]

agent-eval is the only one of the three sibling repositories with no
export-surface / version-bump gate on main. This issue is the decision to adopt
it, deliberately separated from the release train that is in flight now.

What is missing

main has none of it:

• scripts/check-version-bump.mjs
• scripts/check-api-surface.mjs
• scripts/lib/api-surface.mjs
• api-surface.json
• a check:version-bump / check:api-surface script, or any CI step running one

agent-runtime and agent-knowledge both run the gate on every pull request.
agent-eval publishes to the same registry with the same 0.x compatibility
window and has no equivalent check.

The stale branch

The work exists and was never merged: feat/export-surface-gate, written
2026-08-18.

• 3 commits: 3e0e82a3, bd5b63d0, 184aa525
• 59 commits behind main as of 2026-09-01
• +5,275 / −102 lines, of which api-surface.json is 3,495 lines and is 59
  commits stale — it must be regenerated, not merged as-is
• A test-merge into current main conflicts in package.json,
  pnpm-lock.yaml, and src/analyst/benchmark-implementation.ts (~6 lines).
  All resolvable; the lock file regenerates.

It also needs the fix the siblings already took

The gate as written measures a required bump against the base branch's
version, which reads an unreleased version as if it were released. That cost
agent-runtime two admin-merges on 2026-09-01: main declared 0.190.0 while the
registry's newest was 0.189.0, and two export-adding PRs were each refused for
adding exports to a version no consumer could resolve.

Fixed in:

• fix(scripts): measure a version bump against the last published version, not the base branch agent-runtime#1074
• fix(scripts): measure a version bump against the last published version, not the base branch agent-knowledge#186

The corrected script measures against the last published version: the highest
v* tag reachable from the base (each package's version read from its own
manifest at that tag), else the npm registry's latest, else the base version as
before. A version that IS on the registry still demands its own bump.

feat/export-surface-gate's copy of check-version-bump.mjs had already drifted
from the sibling copy before that fix existed, so adopting means taking the
current sibling file verbatim, not merging the branch's version of it.

Why not now

agent-eval has an open release train — the judge transport PR is pending and
0.173.0 is still to cut. Switching on a new gate mid-flight would red every open
export-adding PR before it ships. This lands after 0.173.0.

Adopting, when the train is clear

1. Copy scripts/check-version-bump.mjs, scripts/check-api-surface.mjs and
   scripts/lib/api-surface.mjs verbatim from agent-runtime main. They
   read everything repo-specific out of the manifests they inspect; nothing in
   them names a repository.
2. Copy tests/version-bump-check.test.ts verbatim — its fixture builds a
   synthetic throwaway repository, so it needs no adaptation.
3. pnpm run build && pnpm run api:surface to generate api-surface.json
   against current main.
4. Add check:version-bump and check:api-surface scripts, and the CI step —
   ordered as in the siblings, where check:version-bump runs before Lint and
   Test.
5. Restore the third name in the header roster of check-version-bump.mjs. It
   currently reads "agent-knowledge and agent-runtime", corrected in
   tangle-network/agent-runtime#RUNTIME_PR and
   tangle-network/agent-knowledge#KNOWLEDGE_PR, because the roster named a
   repository that did not carry the file.

Expect the first run to demand a bump for anything already merged since the last
tag that moved the surface.