Bundle atomic Business session persistence

[a-github-name]

Summary

• bundle the exact generated Business adapter from sawfwair/mere-business#86 at source commit 6f86589e7d345a49f6b05e3fe884de344cc5b6fa
• preserve the root-canonical leading-global behavior from stacked Business #85
• add a root-bundle regression that races different-sized writes to one isolated session and proves parseability, private 0600 mode, and no temporary-file residue
• harden packed-install smoke coverage with an isolated HOME/XDG state and a real delegated Business no-session check

Source truth and merge gate

This draft is intentionally blocked. Do not merge, version, publish, or release this root CLI change before the upstream Business source lands.

Required order:

1. sawfwair/mere-business#85 lands.
2. stacked sawfwair/mere-business#86 lands.
3. the bundled bytes are revalidated against the merged upstream Business artifact.
4. only then may this downstream PR become merge/release eligible.

The imported adapters/business/run.js is byte-identical to packages/cli/dist/index.js at Business commit 6f86589e7d345a49f6b05e3fe884de344cc5b6fa.

• SHA-256: e47fa02c26da48a743b0671a9fe8cd79b43784fa04535db0a8ef0b248d7188f5
• root CLI package version remains 0.5.17
• no npm publish, global install, real session mutation, release tag, or merge is included

Verification

• pnpm verify — passed: 77 tests, coverage, 16-adapter safety/coverage, 379 MCP tools, supply-chain and package-content gates
• pnpm test:pack — passed against a clean temporary global prefix and isolated HOME/XDG state
• concurrent bundled Business session regression — passed through the real root CLI dispatch path
• staged gitleaks scan — passed
• git diff --check — passed
• Business #86 security checks — secret scan, dependency audit, and Semgrep passed; its verify job is currently blocked during install because GitHub Actions cannot read the private mere-docs git dependency

Known baseline dependency finding

pnpm audit --audit-level moderate reports the existing default-branch transitive ip-address <=10.1.0 advisory through @modelcontextprotocol/sdk -> express-rate-limit (GHSA-v2v4-37r5-5v8g). This focused adapter import does not change package manifests, lockfiles, or shrinkwrap state.