chore(release): prepare agent-runtime 0.282.2

[drewstone]

0.282.1 (#1446, merged ecb9346, tagged v0.282.1) widened the agent-eval peer range to <0.201.0 without bumping the pinned devDependency, which violates scripts/lib/dependency-contract.mjs's window rule (the peer window must end at the pinned dev version's next minor). publish.yml run 36327174930 caught it: verify-official-optimizers and verify-runtime-bench both failed with agent-eval peer must end at its development minor: expected >=0.199.0 <0.200.0, found >=0.199.0 <0.201.0. publish-npm needs both jobs, so it never ran — npm never served 0.282.1; npm view @tangle-network/agent-runtime dist-tags still shows latest: 0.282.0. v0.282.1 stays as an unpublished tag (same pattern as the documented 0.270.0/0.278.x gaps).

I tried the full fix (bump the dev pin to 0.200.0 too, per the contract's actual rule) and hit a real transitive block: @tangle-network/agent-knowledge@17.1.10 declares agent-eval >=0.182.0 <0.200.0 and refuses 0.200.0, so pnpm install fails strict peer resolution with Eval 0.200.0 pinned. Admitting Eval 0.200.x needs a Knowledge peer bump first — a different repo/release, outside this package's scope.

This PR reverts just the eval peer/docs change (back to >=0.199.0 <0.200.0, dev pin back to 0.199.0) and keeps the two other 0.282.1 fixes, which are unaffected and already proven in their own PRs:

• Sandbox 0.56.x peer admission (fix(deps): admit Sandbox 0.56 in Runtime's peer range #1445)
• isolated-check input limits + explicit memory-grant verification (fix(runtime): bound isolated check input on request #1443)

pnpm run release:prepare bumped to 0.282.2 (patch) and regenerated the changelog, api-surface.json, the primitive catalog, docs/canonical-api.md and the versioned fixtures.

Proof

• pnpm install --frozen-lockfile && pnpm peers check on drew-gtr-pro: clean, no peer issues, dev pin back at 0.199.0.
• Isolated repro of the contract check that failed CI: node scripts/verify-official-optimizers.mjs now passes assertCohortRange/assertRuntimeDependencyAdmits and proceeds into the real build + GEPA/optimizer verification (killed by PID after confirming the contract check no longer throws and pnpm build inside it succeeded, to avoid burning the full paid optimizer run twice — CI runs it again on this PR).
• pnpm exec tsc --noEmit: clean.
• pnpm run build: 124 files, clean.
• No test files touched (git diff --name-only origin/main -- '**/*.test.ts' '**/*.test.mjs' empty).

After merge: tag v0.282.2 at the merged main tip, verify publish.yml (all four publish-npm dependencies green this time), then npm view and a real consumer run.

[tangletools]

✅ Auto-approved PR — 58b3221a

Blanket team auto-approval is intentional. The merge gates are CI and codex-p1.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-09-27T14:56:53Z}