chore(cli): CTC-5458 — release publisher fix in 0.16.16

[ryanrozich]

Summary

Release the CTC-5458 attachment metadata fix from merged #387 as CLI and skills bundle 0.16.16. The forwarder and plugin carry the same patch version; no runtime code changes in this PR.

Validation

• node .agents/skills/release-train/scripts/train-status.mjs --catalyst-cloud . from catalyst-cloud: every published member remains on 0.16.
• bun run release:check: pass.
• node scripts/sync-plugin-version.mjs --check: plugin, forwarder, and eight skill provenance stamps match 0.16.16.
• bun install --frozen-lockfile, bun run typecheck, git diff --check: pass.
• fix(cli): CTC-5458 — include metadata in attachment writes #387 carried the functional change; its CI and one full local Codex review passed at exact head 24e6872.

Release

After this PR merges and required checks pass, push skills-bundle-v0.16.16 from merged main. The tag workflow runs full coverage and publishes both npm packages. Verify workflow and registry readback before claiming publication. CTC-5458 browser publisher #12403 must also merge before a fresh browser-verify --publish proof.

[ryanrozich]

[hand-merger] ONE local Codex full review of this PR is complete: PASS, no actionable findings. Exact PR head c068de3/tree e6e635daa382a44ed4c7be0b701370c14c97a569, base 75d603a/tree 8c721a532ca4ac0652cf95194916cd57e1862340. Mini Codex CLI v0.160.0, gpt-6-sol medium, session 01a14982-e389-7403-a22a-eb82df92df68, exit 0. The review verified the synchronized 0.16.16 package/plugin/skill provenance bump and changelog. Its only observation was that the attachment metadata fix described in the changelog is already present and tested in the base commit, as expected for a release PR. Exact-head CI Node 22/24/26 and CodeQL are green. Do not request a second full review on this PR; after any fixes, check only the delta.

[mergify]

Merge Protections

🟢 Merge protection satisfied — ready to merge.

Show 1 satisfied protection

🟢 no unresolved review threads before merge

• #review-threads-unresolved=0

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-10-17 11:01 UTC · Rule: default · triggered by rule enqueue any green, thread-clean, non-held PR
• ✅ Checks passed · on draft merge queue: checking #389 on main (75d603a) #390
• ✅ Merged — 2026-10-17 11:08 UTC · at f41b6d6daf17ab1e625197ede276ef7ff60805f6 · squash

This pull request spent 6 minutes 39 seconds in the queue, including 5 minutes 36 seconds running CI.

Required conditions to merge

• #review-threads-unresolved=0
  • chore(cli): CTC-5458 — release publisher fix in 0.16.16 #389
• base=main
• check-success=check
• label!=hold
  • chore(cli): CTC-5458 — release publisher fix in 0.16.16 #389
• all of [🛡 Merge Protections rule no unresolved review threads before merge]:
  • #review-threads-unresolved=0
    • chore(cli): CTC-5458 — release publisher fix in 0.16.16 #389