Preserve Squad CLI version in compiled action workflows #1884

Summary

/squad cast failed in ReadR run https://github.com/bradygaster/ReadR/actions/runs/32900470947 because the compiled workflow lost SQUAD_CLI_VERSION and resolved an older CLI that does not provide health.

Root cause

workflows/shared/squad.md declares SQUAD_CLI_VERSION at job level, but the generated squad.lock.yml does not retain that environment binding. The compiled invocation therefore becomes effectively:

npx --yes "@bradygaster/squad-cli@" health --json

npm resolves latest (0.12.0 at the time of the failed run), which lacks the health command.

This is not fundamentally an npx versus npm install -g problem: either mechanism exposes the features of the resolved package version. Switching to a global install without fixing version propagation would install the same incompatible version.

The source fallback is currently 0.14.0, which is unpublished; the pending release appears to be 0.13.0.

Proposed fix

1. Set SQUAD_CLI_VERSION using step-level env on every step that consumes it so gh-aw compilation preserves the value.
2. Pin the highest published release containing health—expected to be 0.13.0.
3. Recompile and inspect the generated lock workflow.
4. Rerun /squad cast only after npm and compiled-workflow validation succeeds.

Validation

npm view @bradygaster/squad-cli@0.13.0 version
gh aw compile squad --strict
gh aw audit <new-run-id> --repo bradygaster/ReadR --json

Scope note

Handle this after or in coordination with the active gh-aw/release work; do not patch generated lock files directly.