Release 0.2.1: pin json-canonicalize and test clean installs before publishing

[asiridalugoda]

Objective

A clean install of @helixar_ai/hdp 0.2.0 cannot be loaded. The core declares json-canonicalize@^2.0.0, and json-canonicalize 2.0.1, published on 2026-08-14, does not include the bundles/ directory that its main entry points to. require('@helixar_ai/hdp') therefore fails with MODULE_NOT_FOUND, and so do @helixar_ai/hdp-mcp and @helixar_ai/hdp-autogen, which load the core. The repository lockfile pins 2.0.0, so CI did not see the failure. hdp-validate bundles its dependencies and is not affected.

Change

• Pin. json-canonicalize is pinned to exactly 2.0.0, the version every test runs against. Canonicalization output, and therefore every signature, is unchanged.

• Versions. The four npm packages that the v* tag publishes move to 0.2.1: @helixar_ai/hdp, @helixar_ai/hdp-mcp, @helixar_ai/hdp-autogen and hdp-validate. The Python packages are unaffected and stay at 0.2.0.

• Release smoke test. Before any npm publish job runs, the release workflow:

  • packs the vetted artifacts as they will be published, including the rewritten core dependency;
  • installs them into an empty directory with fresh dependency resolution;
  • loads each package.

  A failure stops the release.

Verification

• The smoke test fails when run against the 0.2.0 dependency range and passes with the pin.
• The full local gate passes.