fix(codegen): resolve skill bundle deps from the lathe runtime

[samzong]

Summary

Fixes #195. With skill.bundle: true, codegen ran a hardcoded go get github.com/lathe-cli/kitup/go@v0.1.3 github.com/lathe-cli/kitup/go-cobra@v0.1.3. Lathe's own go.mod had moved to kitup/go v0.1.4, so MVS downgraded the runtime github.com/lathe-cli/lathe from v0.6.2 to v0.6.1 and the generated CLI failed to start, while bootstrap exited 0. The constant drifted because dependabot only updates go.mod.

• New pkg/skillbundle.Mount owns the kitup imports. Generated modules_gen.go calls it instead of importing kitup directly, so Lathe's go.mod (which now also requires kitup/go-cobra) is the only source of kitup versions, and dependabot bumps both together.
• Codegen replaces the exact-version pin with go mod tidy, which never downgrades. It is skipped in workspace mode, where tidy ignores go.work.
• Removed the version constants and the pinned command from the docs.

Verification

• make check: passed.
• Reproduced bug: bootstrap v0.6.2 downgrades the runtime to v0.6.1 by pinning kitup v0.1.3 #195 on examples/petstore with bundle enabled and published v0.6.2: go: downgraded github.com/lathe-cli/lathe v0.6.2 => v0.6.1, then __lathe verify failed with generated CLI failed to start.
• Same module with this branch's generator (runtime via replace): the lathe requirement is unchanged, kitup/go and kitup/go-cobra resolve to v0.1.4, and __lathe verify --json returns ok: true, including skill_install.
• go.work with the app and this checkout: codegen skips tidy, build succeeds, and __lathe verify returns ok: true.
• New generator against runtime v0.6.2 (which lacks pkg/skillbundle): codegen fails with a hint to keep the runtime at the generator version, and go.mod stays at v0.6.2.
• Non-bundle CLI: no kitup requirement. pkg/runtime, pkg/lathe, and pkg/config do not depend on kitup.
• TestRunCodegen_SkillBundleGeneratesEmbedAndTidiesDeps and TestRunCodegen_SkillBundleSkipsTidyInWorkspace fail on main and pass on this branch.

Not verified:

• Behavior against a published release that contains pkg/skillbundle. With a runtime older than that release, go mod tidy will resolve the missing package by upgrading github.com/lathe-cli/lathe to @latest (shown in its output) instead of failing.
• lathe init end to end. Starter templates do not enable skill.bundle, so init does not take this path.

Compatibility

• Generated command shape, catalog schema, runtime.SchemaVersion, and CatalogSchemaVersion are unchanged.
• New downstream-facing package pkg/skillbundle. Code generated by this version needs a runtime that contains it. Code generated by earlier versions still builds against this runtime.
• Bundle codegen now runs go mod tidy instead of go get <pinned versions>. Documented in docs/cli-usage.md and docs/architecture.md.

Checklist

• Tests or focused verification cover the changed surface.
• User-facing behavior changes are documented.
• Generated output under internal/generated/, .cache/, and ad-hoc skills/<cli-name>/ directories is not committed.
• Commits are signed off when this is ready to merge.

[codspeed]

Merging this PR will degrade performance by 34.78%

⚠️ Unknown Walltime execution environment detected

Using the Walltime instrument on standard Hosted Runners will lead to inconsistent data.

For the most accurate results, we recommend using CodSpeed Macro Runners: bare-metal machines fine-tuned for performance measurement consistency.

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

❌ 21 regressed benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	yaml-large	9.2 ms	15.8 ms	-41.5%
❌	small	94.8 µs	160.4 µs	-40.91%
❌	BenchmarkFindCatalogCommand	5.6 µs	9.4 µs	-40.59%
❌	json-small	172 µs	289.3 µs	-40.54%
❌	small	127.6 µs	208.4 µs	-38.78%
❌	large	1.1 ms	1.8 ms	-38.04%
❌	large	1.6 ms	2.6 ms	-37.89%
❌	BenchmarkCatalogJSON	2 ms	3.2 ms	-36.56%
❌	BenchmarkFormatTableInferredColumns	765.7 µs	1,205.2 µs	-36.47%
❌	json	886.8 µs	1,373 µs	-35.41%
❌	miss	2.5 ms	3.9 ms	-35.29%
❌	table	507.5 µs	779.7 µs	-34.91%
❌	hit	2.6 ms	3.9 ms	-34.08%
❌	small	81.9 µs	122.4 µs	-33.14%
❌	yaml	3.5 ms	5.3 ms	-33.05%
❌	small	101.3 µs	149.2 µs	-32.09%
❌	BenchmarkParseNormalize	5.3 ms	7.6 ms	-30.03%
❌	large	1.7 ms	2.4 ms	-29.5%
❌	large	1.2 ms	1.6 ms	-28.2%
❌	json-large	2.5 ms	3.4 ms	-26.93%
...	...	...	...	...

ℹ️ Only the first 20 benchmarks are displayed. Go to the app to view all benchmarks.

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing fix/bootstrap-kitup-downgrade (6e46ecd) with main (f50de53)}