Bare standalone packaging — scripts/bare-standalone.cjs, make.cjs, hosts.cjs, prepare-pack.mjs (kernel sync, node_modules flatten, optional sshcrypto.node omit)

Entries + OTA — bin/bare-os-*.mjs + lib/bare-os-ota.mjs (pear-runtime, --no-updates / BARE_OS_OTA_DISABLE)
Upgrade links on seeder/booter package.json
Gitea rolling — .gitea/workflows/release-rolling.yml + scripts/gitea-rolling-release.sh (RELEASE_TOKEN)
by-arch + pear-ci — scripts/pear-stage-by-arch.sh, ci/snapshot-*.json (PEAR_PRIMARY_KEY)
pear run retired from npm/PM2/docs; see docs/BINARY-RELEASE.md

scripts/prepare-pack.mjs

@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+/**
+ * Prepare seeder/booter trees for bare-pack: sync kernel, flatten node_modules,
+ * copy workspace / file: deps that packing cannot follow via symlinks.
+ *
+ * Usage:
+ *   node scripts/prepare-pack.mjs              # both
+ *   node scripts/prepare-pack.mjs seeder
+ *   node scripts/prepare-pack.mjs booter
+ */
+import { spawnSync } from 'node:child_process'
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const SEEDER = path.join(root, 'packages', 'bare-os-seeder')
+const BOOTER = path.join(root, 'packages', 'bare-os-booter')
+const PROTO = path.join(root, 'packages', 'bare-os-protocol')
+const BARE_SSH2 = path.join(root, 'packages', 'bare-os-openssh', 'vendor', 'bare-ssh2')
+
+function log(...a) {
+  console.log('[prepare-pack]', ...a)
+}
+
+function run(cmd, args, cwd = root) {
+  log(`$ ${cmd} ${args.join(' ')}`)
+  const r = spawnSync(cmd, args, { cwd, stdio: 'inherit', env: process.env })
+  if (r.status !== 0) process.exit(r.status || 1)
+}
+
+function copyTree(src, dest) {
+  fs.rmSync(dest, { recursive: true, force: true })
+  fs.cpSync(src, dest, { recursive: true })
+}
+
+function patchBareSsh2ForPack(nm) {
+  const cryptoJs = path.join(nm, 'bare-ssh2', 'lib', 'protocol', 'crypto.js')
+  if (!fs.existsSync(cryptoJs)) return
+  let src = fs.readFileSync(cryptoJs, 'utf8')
+  const needle = "binding = require('./crypto/build/Release/sshcrypto.node')"
+  if (!src.includes(needle)) return
+  // bare-pack cannot resolve optional native .node; JS crypto path is enough
+  src = src.replace(
+    needle,
+    "binding = null /* bare-os pack: omit optional sshcrypto.node */"
+  )
+  fs.writeFileSync(cryptoJs, src)
+  log('patched bare-ssh2 crypto.js (omit sshcrypto.node)')
+}
+
+function preparePkg(pkgDir, { withKernel = false, withSsh2 = false } = {}) {
+  const rel = path.relative(root, pkgDir)
+  log(`prepare ${rel}`)
+  run(process.execPath, [
+    path.join(root, 'scripts', 'ensure-pear-node-modules.mjs'),
+    rel,
+  ])
+  const nm = path.join(pkgDir, 'node_modules')
+  copyTree(PROTO, path.join(nm, 'bare-os-protocol'))
+  if (withSsh2 && fs.existsSync(BARE_SSH2)) {
+    copyTree(BARE_SSH2, path.join(nm, 'bare-ssh2'))
+    patchBareSsh2ForPack(nm)
+  }
+  if (withKernel) {
+    const kernelSrc = path.join(root, 'kernel')
+    const kernelDest = path.join(pkgDir, 'kernel')
+    log(`sync kernel/ → ${path.relative(root, kernelDest)}`)
+    fs.mkdirSync(kernelDest, { recursive: true })
+    fs.cpSync(kernelSrc, kernelDest, { recursive: true })
+  }
+}
+
+const which = process.argv[2] || 'both'
+if (which === 'seeder' || which === 'both') {
+  preparePkg(SEEDER, { withKernel: true })
+}
+if (which === 'booter' || which === 'both') {
+  preparePkg(BOOTER, { withSsh2: true })
+}
+log('done')