Ecosystem floor: converge the substrate minors, vitest, and foundry's ci.yml across the four repos

> **Posted by Claude (AI assistant) on jmchilton's behalf.** They did not write this text.

Follow-up to #22, which is closed. #22's items 1–3 landed in #23 (foundry-pattern's site is on the
reference stack). What is left is everything that could not be decided or done from inside one repo:
four axes across `galaxyproject/foundry`, `jmchilton/statistical-genomics-foundry`,
`jmchilton/foundry-lib`, and this repo.

The framing that ties them together: **the checklist's REFERENCE STACK table is a spec that no
mechanism enforces.** Every item below is a place where a repo drifted from it, or from another
repo, and nothing reported it.

---

## 1. The substrate minors, and the fact that this recurs silently

This is #22's comment item, and it is now demonstrably self-refilling. Measured against npm:

| package | published | foundry | statgen | foundry-pattern |
|---|---|---|---|---|
| kind-manifest | 0.4.0 | `^0.4.0` ✓ | `^0.4.0` ✓ | `^0.4.0` ✓ |
| kind-schema | 0.5.0 | `^0.5.0` ✓ | `^0.5.0` ✓ | — |
| tag-registry | 0.1.0 | `^0.1.0` ✓ | `^0.1.0` ✓ | `^0.1.0` ✓ |
| reference-contract | 0.1.0 | `^0.1.0` ✓ | `^0.1.0` ✓ | — |
| **license-policy** | **0.2.0** | `^0.1.0` ✗ | `^0.1.0` ✗ | — |
| **wiki-links** | **0.3.0** | `^0.1.0` ✗ | `^0.1.0` ✗ | `^0.2.0` ✗ |

**The recurrence is not hypothetical.** #23 bumped foundry-pattern's `wiki-links` `^0.1.0` → `^0.2.0`
specifically to clear this. `wiki-links` 0.3.0 published in the same window, so that repo was stale
again before the PR was merged — on the exact package the bump was about. 0.3.0 is additive
(`resolveWikiLinksInMarkdown`), so nothing broke, and nothing said anything.

Work:

- Bump by hand in foundry (root `package.json`, `site/`, `packages/note-schema/` — a workspace needs
one version across every member), statgen (`site/`), foundry-pattern (`site/`). Verify what
**resolved on disk**, not what the ranges permit.
- The checklist's own substrate table is stale in the same way and should move with them:
`content/pattern/standing-up-a-foundry.instructions.txt:110` says `license-policy ^0.1.1`, `:118`
says `wiki-links ^0.1.0`.
- **Add the check.** A caret on `0.x` cannot cross a minor, so this recurs on every foundry-lib
release with no signal. Something in CI should fail when an installed `@galaxy-foundry/*` is
behind the latest published minor. Without it, the checklist's warning is the only thing standing
between three repos and a stale substrate — and it just demonstrably wasn't enough.

Open question: does the check live in each consumer's CI, or once in foundry-lib as a
release-time sweep that opens bump PRs?

## 2. Converge vitest (#22 item 4)

Still three majors, and now four repos to consider — foundry-lib was not in #22's table:

| | vitest |
|---|---|
| checklist table (`:81`) | `^3.2.4` |
| statistical-genomics-foundry | `^3.2.4` |
| foundry-lib (all six packages) | `^3.2.4` |
| foundry (root + all workspace packages) | `^2.1.0` |
| **foundry-pattern** | **`^4.1.10`** |

foundry-lib being on `^3.2.4` is new information and moves the cost: **`^3.2.4` is now what three of
the four already run**, and converging there means foundry moves up one major and foundry-pattern
moves down one. Converging on `^4` instead moves the table, statgen, foundry (two majors), and six
foundry-lib packages.

Whichever wins, the table and every repo move together. Needs a decision before anyone starts.

## 3. Give foundry a `ci.yml` (#22 item 5)

Unchanged. `galaxyproject/foundry` has `deploy.yml`, `packages.yml`, `planemo-drift.yml`,
`release.yml`, `verification-workflows.yml` — no `ci.yml`. The validate/typecheck/test/build
sequence Part 4 describes runs inside `packages.yml`.

Either split it out, or change what Part 4 says. It should not stay a difference nobody has decided.

## 4. kind-manifest's reader-only subpath (#22 item 3, option b)

#23 took option (a): foundry-pattern states `zod: ^4.4.3` and carries one runtime dep for a site that
defines no schemas. Option (b) is still the version that matches what the checklist claims about the
split:

> its reader half has a consumer that only ever reads manifests other Foundries produced and never
> defines a kind.

Work: a `@galaxy-foundry/kind-manifest/read` subpath in foundry-lib with no zod import, then
foundry-pattern depends on that and drops zod.

**Caveat worth settling first:** `parseKindManifest` *is* the zod validator. A zod-free reader means
either hand-writing the validation or shipping an unvalidated reader — and foundry-pattern's
`loadManifest` deliberately parses rather than casts, because a manifest that stopped matching the
format should fail where the problem is. If (b) costs that, (a) may be the right permanent answer
and the checklist sentence is what should change.

## 5. Convergence nits surfaced while doing #23

Small, individually arguable, listed so they are not rediscovered a fourth time:

- **`astro build` vs `astro build --force`.** Both instances use `--force`; foundry-pattern does not.
Not cosmetic: Astro's content-layer cache masked a verification run during #23 — a rebuild after a
config change reported stale output.
- **`astro-pagefind` placement.** `dependencies` in foundry-pattern, `devDependencies` in both
instances.
- **npm vs pnpm.** foundry-pattern uses npm with `package-lock.json`; the REFERENCE STACK table says
pnpm via corepack with `packageManager` pinned in `package.json`. The table is currently false of
this repo on that row.
- **foundry-pattern's vendored instance snapshots** (`npm run check:instances`) report stale against
current instance HEADs. Not in `ci.yml`, so nothing gates it.

---

**Out of scope**, as in #22: the kind-schema / note-schema / validator-placement divergence between
the two instances is a separate axis being planned on its own.

Start by comparing the root package.json, site/ and packages/note-schema/ manifests across the four repositories, then read content/pattern/standing-up-a-foundry.instructions.txt:81, :110 and :118. Inspect foundry's existing packages.yml and other workflows, and run the checks named in the issue, including npm run check:instances. Done requires an agreed convergence plan and coordinated dependency, checklist, workflow, and validation changes.

Written by the indexing model from the issue text.