Replace the local tty repair with a fixed upstream release #1218

Story

Use the published @bomb.sh/tty package again once an upstream release contains the text-measurement cache repair, and remove the temporary source-build and vendor machinery introduced by PR #1217.

The REPL must keep the corrected widths, complete source text and safe cache-key lifetimes after that replacement.

Current gap and release condition

PR #1217 repairs #1216 by preparing a locally patched tty 0.9.0 runtime. Its maintained patch, recipe, compiler preparation, generated runtime routing and distribution wiring exist because the published package lacks the repair.

The upstream port is bombshell-dev/tty#173; the underlying Clay report is nicbarker/clay#664. The local repair merged in executable.md PR #1217 on 2026-11-10 at 79abfdaafef01442ccc236002f45da86e1e95c6e. The upstream tty PR remains open; this ticket waits for a qualifying published tty release.

Start removal only when a published tty release includes the complete applicable repair: text/config equality after hash matches, bounded retained key ownership, copying only published entries, safe oversized-frame borrowing and clearing borrowed keys after presentation. An upstream merge or closed Clay issue alone does not satisfy this release condition. Record the selected package version and the upstream commit/release evidence.

Acceptance

• XMD consumes the qualifying published tty runtime through its supported package interfaces. Dependency manifests and frozen locks agree, and deno task setup prepares the resulting graph.
• Remove the tty-specific vendor patch, recipe, producer/compiler preparation, generated runtime directory and its readiness checks; remove their dedicated fixtures, exclusions, notices and build/distribution branches where they are no longer used. Update the release-process specification to describe the published dependency. Keep shared preparation and staging behavior needed by other consumers.
• Preserve and adapt the behavior regressions from Fix REPL source measurement cache collisions #1217 rather than reverting the PR wholesale: same-frame and cross-frame collision widths remain 57/91, full-frame drawing and wrapping preserve every source byte, key storage remains safe through reuse/resize/oversized frames, and capacity refusal does not corrupt packed input. Passive cold-history navigation keeps saved outcomes and causes no provider calls.
• The published package passes those regressions through the CLI's actual runtime graph. The known-bad tty 0.9.0 payload fails the collision regression as the negative control; retain that evidence without adding it as a production dependency.
• npm runtime/types, JSR publication and the compiled CLI work with the published dependency and preserve applicable license obligations. None depends on the removed local producer or generated tty directory.

Verification

Run the affected cache and history tests (packages/cli/tests/repl-tty-cache.test.ts and packages/cli/tests/repl-journey.test.ts) and the actual distribution checks (scripts/tests/cli-npm-bin.test.ts and the applicable cases in scripts/tests/tty-distribution.test.ts). Adapt or retire producer-only tests with the removed producer. Follow the repository's dependency-change procedure, committed deno task verify:clean before pushing, and required CI.