feat: 薄殼原則落地 + seed 下沉 API + MCP 進主庫 + 部署一致性

壓測四橫向問題修正（docs 壓測報告）：

① 薄殼原則成鐵律：能力長在 API，CLI/MCP/lib 只暴露
   - seed 下沉成 API 行為：cypher-executor POST /init/seed（一次灌 API+auth recipe），
     種子資料移到 server src/lib/api-recipe-seeds.ts，CLI 改薄殼一次呼叫
   - 解除 deployFullyOk 連坐 + init 補 seed auth recipe + update 補 seed/全 KV
   - registry SUBMISSIONS_KV 補進 REQUIRED_KV_NAMESPACES（修 20/21）

② MCP 統一帳號來源（單一 remote MCP + .env 切 MCP URL）
   - MCP 從 sibling repo 搬進 arcrun/mcp/（remote Worker，route 改 mcp.arcrun.dev）
   - config 加 mcp_url 三層解析 + getMcpUrl + DEFAULT_MCP_URL
   - 新增 acr mcp-setup：依 config 寫專案 .mcp.json（接案切資料夾自動切 MCP）
   - acr --version 改動態讀 package.json（根治漂移）

③ Deploy 一致性
   - tests/release.feature + scripts/check-release.sh
   - local-deploy.sh：CLI npm publish + auto patch bump + CHANGELOG
   - local-deploy.sh bash 3.2 相容修正（mapfile / 空陣列 set -u）
   - builtins/pnpm-lock.yaml

④ README self-hosted 同步現況（移除 R2 殘留、加 flag/env、多帳號）

CLI bump → 1.3.0

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/local-deploy.sh

@@ -49,7 +49,11 @@ done
 # 排除 node_modules、wrangler.test.toml、Pages 專案
 echo "🔍 Scanning worker directories..."
 
-mapfile -t ALL_DIRS < <(
+# bash 3.2（macOS 內建）沒有 mapfile → 用 while read 相容寫法
+ALL_DIRS=()
+while IFS= read -r d; do
+  [ -n "$d" ] && ALL_DIRS+=("$d")
+done < <(
   find . -type f -name 'wrangler.toml' \
     -not -path '*/node_modules/*' \
     -not -name 'wrangler.test.toml' \
@@ -93,19 +97,22 @@ else
     exit 1
   fi
 
-  mapfile -t CHANGED < <(git diff --name-only "$BASE_REF" HEAD)
+  CHANGED=()
+  while IFS= read -r f; do
+    [ -n "$f" ] && CHANGED+=("$f")
+  done < <(git diff --name-only "$BASE_REF" HEAD)
   echo "Changed files (${#CHANGED[@]}):"
-  for f in "${CHANGED[@]}"; do echo "  $f"; done
+  for f in ${CHANGED[@]+"${CHANGED[@]}"}; do echo "  $f"; done
 
   for d in "${ALL_DIRS[@]}"; do
     hit=0
-    for f in "${CHANGED[@]}"; do
+    for f in ${CHANGED[@]+"${CHANGED[@]}"}; do
       if [[ "$f" == "$d"/* ]]; then hit=1; break; fi
     done
     # 連動：改 registry/components/{name}/ 也要 deploy .component-builds/{name}/
     if [[ $hit -eq 0 && "$d" == .component-builds/* ]]; then
       name="${d#.component-builds/}"
-      for f in "${CHANGED[@]}"; do
+      for f in ${CHANGED[@]+"${CHANGED[@]}"}; do
         if [[ "$f" == "registry/components/$name"/* ]]; then hit=1; break; fi
       done
     fi
@@ -132,9 +139,9 @@ done
 echo ""
 echo "📦 Deploy plan:"
 echo "  Tier 1 (components, ${#TIER1[@]}):"
-for t in "${TIER1[@]}"; do echo "    - $t"; done
+for t in ${TIER1[@]+"${TIER1[@]}"}; do echo "    - $t"; done
 echo "  Tier 2 (orchestration, ${#TIER2[@]}):"
-for t in "${TIER2[@]}"; do echo "    - $t"; done
+for t in ${TIER2[@]+"${TIER2[@]}"}; do echo "    - $t"; done
 echo ""
 
 if [[ "$DRY_RUN" == true ]]; then
@@ -198,10 +205,10 @@ deploy_one() {
 }
 
 FAILED=()
-for d in "${TIER1[@]}"; do
+for d in ${TIER1[@]+"${TIER1[@]}"}; do
   deploy_one "$d" || FAILED+=("$d")
 done
-for d in "${TIER2[@]}"; do
+for d in ${TIER2[@]+"${TIER2[@]}"}; do
   deploy_one "$d" || FAILED+=("$d")
 done
 
@@ -211,6 +218,71 @@ if [[ ${#FAILED[@]} -eq 0 ]]; then
   echo "✅ All ${#TARGETS[@]} workers deployed successfully"
 else
   echo "⚠️  ${#FAILED[@]}/${#TARGETS[@]} workers failed:"
-  for f in "${FAILED[@]}"; do echo "  ❌ $f"; done
+  for f in ${FAILED[@]+"${FAILED[@]}"}; do echo "  ❌ $f"; done
+fi
+
+# ── 6. CLI npm publish（壓測報告第 3 點：deploy 不只推 worker，npm CLI 也要同步）──
+# 「推送 = 全部 publish target 到位」（tests/release.feature）。worker 走 wrangler，
+# CLI 走 npm。只有 cli/ 在本次 diff 內 + 版本比 npm 新時才 publish（同版跳過，不假失敗）。
+# 不在 --dry-run 時跑。需 npm login（npm whoami 確認）。
+if [[ "${DRY_RUN:-false}" != "true" ]]; then
+  CLI_CHANGED=false
+  for t in "${TARGETS[@]:-}"; do [[ "$t" == "cli" || "$t" == "cli/" ]] && CLI_CHANGED=true; done
+  # --all 或 diff 含 cli/ 都算
+  if git diff --name-only "${BASE_REF}"..HEAD 2>/dev/null | grep -q '^cli/'; then CLI_CHANGED=true; fi
+  if [[ "${DEPLOY_ALL:-false}" == "true" ]]; then CLI_CHANGED=true; fi
+
+  if [[ "$CLI_CHANGED" == "true" ]]; then
+    echo ""
+    echo "▶ CLI npm publish ..."
+    LOCAL_V=$(node -p "require('./cli/package.json').version" 2>/dev/null || echo "?")
+    REMOTE_V=$(npm view arcrun version 2>/dev/null || echo "none")
+
+    # 自動昇版（richblack：deploy 時自動 bump，避免忘了改）：
+    #   若本機版本 == npm 上版本（= 改了 cli 但沒 bump）→ 自動 patch +1。
+    #   留版本記錄：把本次 commit subject 寫進 cli/CHANGELOG.md。
+    if [[ "$LOCAL_V" == "$REMOTE_V" ]]; then
+      echo "  · 版本未 bump（$LOCAL_V 已在 npm），自動 patch +1 ..."
+      NEW_V=$(cd cli && npm version patch --no-git-tag-version 2>/dev/null | tr -d 'v')
+      LOCAL_V="$NEW_V"
+      # CHANGELOG：prepend 新版本 + 本次 commit subject（無 commit 則標 manual deploy）
+      COMMIT_SUBJ=$(git log -1 --format='%s' 2>/dev/null || echo 'manual deploy')
+      COMMIT_DATE=$(git log -1 --format='%ad' --date=short 2>/dev/null || echo '')
+      CHANGELOG="cli/CHANGELOG.md"
+      TMP_CL=$(mktemp)
+      {
+        echo "# arcrun CLI Changelog"
+        echo ""
+        echo "## $NEW_V — $COMMIT_DATE"
+        echo "- $COMMIT_SUBJ"
+        echo ""
+        if [[ -f "$CHANGELOG" ]]; then tail -n +2 "$CHANGELOG"; fi
+      } > "$TMP_CL"
+      mv "$TMP_CL" "$CHANGELOG"
+      echo "  · 已 bump → $NEW_V，並記錄進 $CHANGELOG（記得 commit 這兩個檔）"
+    fi
+
+    if ! npm whoami >/dev/null 2>&1; then
+      echo "  ⚠ 未 npm login（npm whoami 失敗），跳過 publish。手動：cd cli && npm publish"
+      FAILED+=("cli:npm-publish(未登入)")
+    else
+      echo "  📦 publish arcrun $REMOTE_V → $LOCAL_V ..."
+      if (cd cli && npm run build >/dev/null 2>&1 && npm publish --access public 2>&1 | tail -3); then
+        echo "  ✅ npm publish 完成（arcrun@$LOCAL_V）"
+      else
+        echo "  ❌ npm publish 失敗"
+        FAILED+=("cli:npm-publish")
+      fi
+    fi
+  fi
+fi
+
+echo ""
+echo "════════════════════════════════════════════════════════════"
+if [[ ${#FAILED[@]} -eq 0 ]]; then
+  echo "✅ 全部 publish target 到位（worker + 必要時 CLI npm）"
+else
+  echo "⚠️  ${#FAILED[@]} 項失敗（誠實回報，未假綠）："
+  for f in ${FAILED[@]+"${FAILED[@]}"}; do echo "  ❌ $f"; done
   exit 1
 fi