fix: pin production runtime in applications

packages/cli/src/create.ts

@@ -86,6 +86,7 @@ Thumbs.db
   "dependencies": {
     "@wrnexus/ai": "${frameworkVersion}",
     "@wrnexus/core": "${frameworkVersion}",
+    "@wrnexus/dev-server": "${frameworkVersion}",
     "@wrnexus/helpers": "${frameworkVersion}",
     "@wrnexus/styles": "${frameworkVersion}",
     "@wrnexus/validation": "${frameworkVersion}",

packages/cli/src/update.ts

@@ -691,6 +691,22 @@ const MIGRATIONS: Migration[] = [
       // Runtime diagnostics improve automatically after updating and rebuilding.
     },
   },
+  {
+    version: "0.2.70",
+    id: "direct-production-runtime-dependency",
+    description:
+      "Declares @wrnexus/dev-server directly in runnable apps so production bundles resolve the matching runtime release.",
+    apply(ctx) {
+      if (!existsSync(join(ctx.appRoot, "app", "pages"))) return;
+      const file = join(ctx.appRoot, "package.json");
+      const pkg = JSON.parse(readFileSync(file, "utf8")) as Record<string, any>;
+      const dependencies = (pkg.dependencies ??= {} as Record<string, string>);
+      if (dependencies["@wrnexus/dev-server"] === `^${ctx.to}`) return;
+      dependencies["@wrnexus/dev-server"] = `^${ctx.to}`;
+      ctx.log(`+ @wrnexus/dev-server ^${ctx.to}`);
+      if (!ctx.dryRun) writeFileSync(file, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+    },
+  },
 ];
 
 /** Release tooling uses this to require an explicit migration entry per version. */