chore(release): prepare 0.291.0 and Sandbox 0.60 cohort

[drewstone]

Release

Prepare Runtime 0.291.0 through the maintained release:prepare script.
Consume the merged Router Auto and unassessed child-report notes.
Regenerate the versioned fixtures, curated version banner and primitive catalog.

Cohort

Sandbox 0.60 is required for the native status and pending rawEvidence fixes.
Extend the supported Sandbox peer window to >=0.58.4 <0.61.0 and use exact 0.60.0 for development.
Use public Interface 2.16.0 at source 2fed74abeb851d99a33e010d7524f2e0762ef42e, matching Sandbox 0.60's Interface requirement.
Keep the maintained strict package and packed-cohort gates.
No dependency override, deployment, frozen-input change or launch is included.

Evidence and current required hold

• The five realistic parent await_event/observe_agent/durable-reopening cases pass with public Sandbox 0.60.0.
• Final source/example types, build, API regeneration, version-bump gate and docs freshness passed. The transitive lock now resolves public tcloud 0.8.2 and one Sandbox 0.60.0. Bench 0.14.1 pays for its catalog dependency changes without changing benchmark behavior.
• The existing strict packed-consumer gate found a real transitive incompatibility: public Knowledge 18 resolves tcloud 0.8.1, whose Sandbox range ends below 0.60.0. This installs SDK 0.59.0 beside SDK 0.60.0.
• tcloud PR66 merged at ab0881465893f7184ca37ceee3d90a13a0ee2618 and its normal release workflow36876842655 published 0.8.2. The unchanged Runtime package verification now passes with one copy of every required first-party package, including Sandbox 0.60.0. Its packed Worker bundles and executes without Node compatibility. Final-head CI is running.
• SDK rawEvidence source/publication remains independently owned by release task 01a0f0a1.

After normal merge, tag only the current main tip and let the existing Publish workflow verify and publish the immutable archive. The canonical Lab coordinator lane consumes the exact public package identities after publication.

[tangletools]

✅ Auto-approved PR — 3bd287e6

Blanket team auto-approval is intentional. The merge gates are CI and codex-p1.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-10-01T14:00:34Z}

[tangletools]

✅ Auto-approved PR — 486b7c83

Blanket team auto-approval is intentional. The merge gates are CI and codex-p1.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-10-01T14:06:34Z}

[tangletools]

✅ Auto-approved PR — de405fb1

Blanket team auto-approval is intentional. The merge gates are CI and codex-p1.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-10-01T14:49:34Z}

[drewstone]

Public delivery is verified for both companions from merged source d9085951f3fcda8d95050bfb8629cc46d521595f.

• Runtime 0.291.0: public tar is 3,451,761 bytes; SHA256 38db3e63ab45c37af63abd0b39e760e23adc502b02881b4390b99b2dc619a62b.
• Bench 0.14.1: public tar is 1,032,215 bytes; SHA256 1981980519705dec432a19a5f53fbb15f2bcaee5bccb71fc279207a4e673ae8b.
• Both public archives equal their uploaded publisher archives. npm provenance names the exact merged source and each original publisher attempt.
• Actual public installs and signature audits pass with zero invalid and zero missing signatures.
• Bench's actual resolveAdapter('swe-bench') returns swe-bench-verified. The installed family has one copy of Bench, Runtime, Core, Eval, Interface, Knowledge, Sandbox 0.60.1 and TCloud 0.8.2.

Runtime publisher succeeded on attempt 1. Attempt 2 failed E409 while attempting to publish the same staged version; both observations remain retained.
Bench publisher completed successfully. Initial public 404 observations remain retained; the maintained fresh-cache probe and actual native install later succeeded.

Complete artifacts, public metadata, provenance, signatures, lockfiles, native outputs and failed observations: /mnt/traces/runtime-release-02910-20261001. Final receipts: public-package-verification.json and bench-public-package-verification.json.

This proves package publication, installed source and API availability. It makes no new benchmark, scientific, subscription, all-harness or production host-adoption claim.