build: enforce complete private release workflow

packages/cli/src/update.ts

@@ -156,8 +156,29 @@ const MIGRATIONS: Migration[] = [
       if (!ctx.dryRun) writeFileSync(file, JSON.stringify(pkg, null, 2) + "\n", "utf8");
     },
   },
+  {
+    version: "0.2.18",
+    id: "add-helpers-package",
+    description: "Add @wrnexus/helpers to existing runnable applications",
+    apply(ctx) {
+      // Workspace roots do not consume application Context helpers directly.
+      if (!existsSync(join(ctx.appRoot, "app", "pages"))) return;
+      const file = join(ctx.appRoot, "package.json");
+      const pkg = JSON.parse(readFileSync(file, "utf8")) as Record<string, any>;
+      const dependencies = (pkg.dependencies ??= {} as Record<string, string>);
+      if (dependencies["@wrnexus/helpers"]) return;
+      dependencies["@wrnexus/helpers"] = `^${ctx.to}`;
+      ctx.log(`+ @wrnexus/helpers ^${ctx.to}`);
+      if (!ctx.dryRun) writeFileSync(file, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+    },
+  },
 ];
 
+/** Release tooling uses this to require an explicit migration entry per version. */
+export function updateMigrationVersions(): string[] {
+  return [...new Set(MIGRATIONS.map((migration) => migration.version))];
+}
+
 /** Bump every `@wrnexus/*` range to `^target`. Returns the human-readable changes. */
 function bumpDeps(pkg: Record<string, unknown>, target: string): string[] {
   const changed: string[] = [];