fix: stabilize workspace gateway and scaffolding

packages/cli/src/update.ts

@@ -4,7 +4,7 @@
  * Upgrade an app (or every app in a workspace) to a WrNexus release:
  *   1. Bump every `@wrnexus/*` dependency to the target version.
  *   2. `bun install`.
- *   3. Refresh framework-owned reference files (llms.txt) and apply any
+ *   3. Refresh framework-owned reference files (public/llms.txt) and apply any
  *      versioned, idempotent migrations that newer releases introduce.
  *   4. Record the applied version in package.json (`"wrnexus": { version }`).
  *
@@ -19,7 +19,7 @@
 
 import { cpSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { spawnSync } from "node:child_process";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { AI_GUIDE, CLAUDE_MD } from "./ai-guide.ts";
 import { inspectProject } from "./doctor.ts";
@@ -190,11 +190,14 @@ function appVersion(appRoot: string, pkg: Record<string, unknown>): string {
 
 /** Refresh pure framework-owned reference files. Never touches user-edited CLAUDE.md. */
 function refreshFrameworkFiles(appRoot: string, dryRun: boolean, log: (m: string) => void): void {
-  // llms.txt is a generated reference — always safe to overwrite.
-  const llms = join(appRoot, "llms.txt");
+  // Public llms.txt is generated and web-visible, so it is safe to refresh.
+  const llms = join(appRoot, "public", "llms.txt");
   if (!existsSync(llms) || readFileSync(llms, "utf8") !== AI_GUIDE) {
-    log("~ llms.txt refreshed");
-    if (!dryRun) writeFileSync(llms, AI_GUIDE, "utf8");
+    log("~ public/llms.txt refreshed");
+    if (!dryRun) {
+      mkdirSync(join(appRoot, "public"), { recursive: true });
+      writeFileSync(llms, AI_GUIDE, "utf8");
+    }
   }
   // CLAUDE.md is often user-edited — only create it when absent.
   const claude = join(appRoot, "CLAUDE.md");
@@ -223,10 +226,14 @@ function backupProjectFiles(appRoot: string, from: string, target: string): stri
     "tsconfig.json",
     ".gitignore",
     "CLAUDE.md",
-    "llms.txt",
+    "public/llms.txt",
   ]) {
     const source = join(appRoot, name);
-    if (existsSync(source)) cpSync(source, join(backup, name));
+    if (existsSync(source)) {
+      const destination = join(backup, name);
+      mkdirSync(dirname(destination), { recursive: true });
+      cpSync(source, destination);
+    }
   }
   return backup;
 }