ensureSquadStateMcpPinned writes unresolvable version when CLI is a local-build / unpublished pre-release #1204

Root cause

ensureSquadStateMcpPinned(dest, getPackageVersion()) (added in PR #1200, packages/squad-cli/src/cli/core/upgrade.ts:705) writes:

{ "command": "npx", "args": ["-y", "@bradygaster/squad-cli@<cliVersion>", "state-mcp"] }

When <cliVersion> is not on the npm registry (every locally-built tarball, e.g. 0.9.6-preview.5, and any developer's self-built CLI), npx fails at MCP-server startup:

npm error code ETARGET
npm error notarget No matching version found for @bradygaster/squad-cli@0.9.6-preview.5.

The MCP server never starts, the host registers zero tools, and agents correctly report squad_state_* unavailable. Orphan branch does not grow despite all the iter-3 fixes working at config-shape level.

Evidence

• npm view @bradygaster/squad-cli versions --json highest published: 0.9.6-insider.3. No preview.5.
• npm view @bradygaster/squad-cli dist-tags --json: { "latest": "0.9.4", "insider": "0.9.6-insider.3" }
• Reproduced on tamir-squad-hq-tarball-test-20260602T183202. Full RCA report: .squad/files/validation/MCP-LOADER-ROOT-CAUSE.md in the validation companion repo.

Recommended fix (Option A)

Validate the pin against the npm registry before writing. If unresolvable, fall back to @bradygaster/squad-cli@insider dist-tag. About 40 LOC in upgrade.ts plus a regression test in test/mcp-bridge-pinning.test.ts mocking both published-version and unpublished-version registry HEAD responses.

Affects PR #1200 / branch squad/state-backend-upgrade-fixes (this is the same change that introduced the function).

Re-validation

After fix lands and a new twin tarball is built, recreate tamir-squad-hq dup, run squad upgrade --state-backend two-layer, run the 4 continuity prompts from TARBALL-FULL-tamir-squad-hq.md Phase 3.5. Expect git log squad-state --oneline to grow past the 2 baseline commits and Scribe to NOT print the squad_state_* unavailable halt.

Why this is NOT a Copilot CLI bug

The MCP spec is invalid at npm-resolution time. No upstream change required.