[callumalpass]

Design

Reference adoption for the ops weekly train: https://github.com/mdbase-dev/mdbase-cloud-ops/pull/1335 (contract: docs/weekly-app-repin.md).

• Add sdk-repin.yml with one required connect_release input. Restrict it to main and serialize repins without cancellation.
• Use the existing mdbase release automation App: a write token scoped to Reader for the branch/PR/auto-merge, and a separate read-only ops token for the existing production record. Check the exact annotated public tag against that record; no staging/latest fallback and no newly invented release record.
• Preflight all exact npm versions before any write. Advance runtime, dev, optional and peer npm pins plus the production SDK; preserve workspace/file originals and staging/LAB/legacy SDK aliases. Refresh pnpm's lockfile without lifecycle scripts. No changes means success without a PR.
• Maintain one bot PR from automation/sdk-repin, updating its bot-owned branch with an exact force-with-lease and enabling normal auto-merge. Existing required app CI gates the merge.
• Wire dependency-change merges on main into the existing deploy-reader.yml main production path, retaining its reusable CI, environment, clean-tree/build/served-manifest checks and manual/native paths. No new deployment implementation. Reader's existing production environment already permits main and release/native-production; its main branch currently requires Lint, typecheck, test and build, and repository auto-merge is already enabled. These were read, not changed.

Explicit prerequisites / scope

• SDK is not published on npm today. Until Connect PR 1076 lands, its separate SDK publisher is aligned with release versions, and the requested production SDK actually exists, this workflow fails without a partial PR. It does not silently leave beta.141 SDK under newer UI pins, synthesize/relabel a vendor archive, or dispatch the main-only SDK publisher.
• Existing original/provenance/publisher tests remain authoritative for eventual SDK npm intake. No SDK compatibility migration or live qualification is claimed here; app CI must pass before any generated PR merges.
• Ensure the App installation includes Reader and ops, and make RELEASE_AUTOMATION_CLIENT_ID / RELEASE_AUTOMATION_APP_PRIVATE_KEY available to Reader. Missing access fails; no workflow-token fallback. This PR changes no App installation or secrets.
• Reader browser extension shares the future dependency PR but is not yet adopted for weekly store publication: its app-version/tag handoff and failing Chrome submission are documented in the ops adoption table. No extension tags are created by this PR.
• No Writer/TaskNotes/Import migration, native source-branch update, store/environment/protection change or current package repin.

Validation

• rpnpm test:sdk-repin: 5 tests pass on Node 22.22.0 / pnpm 10.7.0, including exact production identity, preserved aliases/originals, exact pin/no-op planning, unsupported input refusal, and a subprocess fixture proving missing SDK writes nothing before a successful repin/repeat no-op.
• rpnpm lint:code: passes for the Reader tree.
• Prettier 3.9.10 checks all changed files; git diff --check passes.
• New sdk-repin.yml: actionlint with ShellCheck passes. Modified deploy-reader.yml: actionlint syntax/expressions pass; its existing ShellCheck SC2034 unused attempt warning remains unchanged.
• Full Reader build/browser/store/live qualification was not run.

PR-only: no merge or auto-merge enabled on this adoption PR, no publish/deploy workflow dispatched, no environment or release record changed. Work was done in a fresh temporary clone, not a /home/calluma/projects checkout.