chore(packages): bump the live-test credential and residue fixes (#1295)

[Juliusolsson05]

Closes #1295. Refs #1329 (already closed by claude-code-headless#68's merge; this makes the app pin it).

Pointer bumps only; the manager authorized them under the PR freeze (temp/manager/assign/w4-pkg-1950.md). Each package PR was reviewed, manager-verified and merged in its own repo. This PR gets its own three reviews.

Package	From → to	Package PR	What changes
agent-transcript-parser	68dbfff → 7e8a67c	#37	The Claude native-resume live test owns both probe launches and the exit wait, and never touches the real login.
workflow-mcp	ef995af → 513374d5	#63, #71	#63: the opt-in Codex live test gets an isolated, access-only login instead of a copy of the real ~/.codex/auth.json, so refresh-token rotation can no longer log the developer out. #71: one shared pollUntil, with run waits that end on every terminal status, replaces the 0.5 s counted polls that failed package CI.
claude-code-headless	f52fc82 → 1cfa8c92	#68	The opt-in composer canary leaves no transcript or cwd in the real ~/.claude, and adds one shared trust entry per checkout family.

All three diffs are test-only. They touch test/, testing/, vitest.config.ts and .gitignore, and no package's package.json changes. So nothing the app builds or ships changes, and the lockfile needs no resync. npm ci --dry-run accepts the unchanged lockfile. (npm install --package-lock-only only dropped unrelated optional peer entries, and I left that out.)

Residuals carried from the package reviews:

• workflow-mcp#63: the disclosed mkdtemp → lstat race (owner option A).
• claude-code-headless#68: NFC normalization of the transcript directory name; the worst case is an unreported leftover directory.

🤖 Generated with Claude Code

[Juliusolsson05]

Review disposition (round 1: a, b, c codex at e8d3b3e3)

a, b, c: MERGE-READY. No findings.

Reviewer	Focus	Result
a	Pointer integrity and supply chain	Each gitlink is a fast-forward to the package PR's merge commit on that package's origin/main (workflow-mcp 513374d5 → 6bcaf113 (#63) → the old pin). Every changed path is under test/, testing/, vitest.config.ts or .gitignore. No src/, manifest, bin or publish-files change, so no app build input or shipped package content changes. npm ci --dry-run exits 0 on the unchanged lockfile.
b	App CI and test wiring	App Vitest and the tsc project references never collect package test/ trees, and npx tsc -b prints 0 lines. check-test-contract scans package tests for .only and passes. Noted: release and preview builds run npm --prefix packages/workflow-mcp test, which now includes #71's converted polls and #63's helper test; they are green in package CI (8/8), and the live Codex test stays excluded. The body's scope claims match the diff.
c	Safety of the pinned live-test helpers	None can copy a refresh token, strand real credentials or delete outside its own run. Three safety mutants are red: the parser inheriting CLAUDE_CONFIG_DIR, the Codex snapshot copying the refresh token, and the target-symlink guard removed. Package core suites pass: parser 228, workflow-mcp 169, claude-code-headless 179. The disclosed residuals are unchanged: one trust entry per checkout family, the mkdtemp/lstat race and the NFC transcript directory.

Nothing to fix. Labels: type:chore, class:C9-tests, sev:P1 (from #1295).

merge-gate.sh agent-code 1463 --member --dry: GATE PASS (e8d3b3e3, 0 behind main, checks green, reviews OK). READY.