`aube deploy` previously rewrote `workspace:*` to a concrete version
and then asked install to resolve it from the registry — fine for
published siblings, broken for the (very common) unpublished-sibling
case. `file:` deps were left untouched, so a `file:../local-vendor`
spec resolved relative to the deploy output dir instead of the source
workspace. There was also no flag to opt out of the implicit `--prod`
default, so deployments that wanted devDependencies (test-harness
deploys, build-step staging) had no way to ask for them.

Now deploy bundles every `workspace:` / `file:` / `link:` ref the
deployed package reaches into `<target>/.aube-deploy-injected/<id>/`
and rewrites the manifest specs to relative `file:` pointers at the
staged copies. Recursion handles siblings whose own deps are workspace
siblings — a bundled sibling's manifest references other bundled
siblings as `file:../<id>` within the injected dir. `file:` directory
targets get the same treatment; `file:` tarballs ship as opaque
archives. Bundled siblings always have devDependencies stripped (a
deploy is a runtime artifact, not a dev environment for siblings).

`--no-prod` opts out of the production default and deploys every dep
kind; combine with `--no-optional` to drop optionals while keeping prod
+ dev. `StripFields::for_args`, `dep_selection_for_args`, and
`keep_dep_for_args` share one axis so the manifest rewrite, the
lockfile subset, and the install dep-selection agree on which dep
types survive.

Reported in #345 (comment).

… refute

Three review fixups on the deploy bundling PR:

- workspace-sibling injections stored the raw `sibling_dir` from
  ws_index in `Injection.source_dir`, but `materialize_injections`
  compared it canonicalized — under symlinks the equality never
  held, so `deployAllFiles=true` silently fell back to pack's
  selection for siblings. Store + enqueue the canonical path so
  the workspace-sibling case mirrors the file:/link: case.
- the `--prod default` bats test had a no-op `[ ! -d ... ] || run cat`
  that always succeeded. Replace with an explicit version refutation
  that only asserts is-number@7.x is absent (transitive 3.x is fine).
- drop the unused `_canonical` arg from `unique_id` — disambiguation
  is by counter, not by path, and the parameter just advertised
  intent that wasn't implemented.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The three deploy helpers — `StripFields::for_args`, `dep_selection_for_args`,
and `keep_dep_for_args` — claimed to "stay in lockstep" but each rederived
the prod/dev/optional axis with a slightly different formula. They happened
to produce equivalent observable output today (the manifest strip drops
optionals under `--dev`, so install never sees them), but the formulas
were a drift hazard.

Extract a single `DepAxis::for_args` source of truth and have all three
consumers destructure from it. As a side effect, `--dev` alone now maps
to `DepSelection::DevNoOptional` rather than `Dev` — observationally
identical because the stripped manifest has no optionals to walk, but
the install state and tracing label now match what actually happens.

Lock the (dev, no_prod, no_optional) -> DepSelection table down with a
matrix test so future drift is caught at compile/test time.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Two bugs surfaced by review on PR #507:

- Tarball injections crashed the rewrite loop. `materialize_injections`
  copies tarballs as opaque archives — no `package.json` lands under
  `inj.target_dir` — but the follow-up `rewrite_local_refs` loop ran
  unconditionally, failing with "No such file or directory" the moment
  any `file:./pkg.tgz` dep appeared. Skip `inj.is_tarball` entries to
  match the materialize side's `continue`.

- Workspace `peerDependencies` shipped raw `workspace:*` to the install
  layer. The previous rewrite path resolved every `workspace:` spec
  (including peers) to a concrete semver via `resolve_workspace_spec`;
  the new bundling pipeline only rewrites peer specs whose sibling is
  in the injection plan, and peers don't get bundled (bundling walks
  deps/devDeps/optionalDeps only). The fall-through left a raw
  `workspace:*` string the standalone install layer cannot parse.
  Restore `resolve_workspace_spec` and call it on the peer-not-bundled
  branch so peer specs become a parseable `1.2.3` / `^1.2.3` / `~1.2.3` /
  literal-suffix range.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Three issues surfaced by review on PR #507, each fixed independently:

1. (P1) Sibling back-deps on the deployed package duplicated it.
   When sibling B declared `"@deployed-pkg": "workspace:*"`, BFS bundling
   would inject the deployed package's own source under
   `.aube-deploy-injected/@deployed-pkg/`, yielding two copies at
   runtime and breaking module-singleton assumptions
   (`require('@deployed-pkg')` from root vs from B returned distinct
   instances). Skip the deployed package's canonical path in
   `plan_injections`, and rewrite back-refs in the manifest rewriter
   to a relative `file:` pointer at the deploy root.

2. (P1) `file:`/`link:` peer specs were silently left unrewritten.
   The plan-miss arm `continue`d for peerDependencies file:/link:
   refs, leaving relative paths that resolve nowhere under the
   deploy target. Hard-fail with a clear message instead — peer
   file: refs aren't a sane shape for a self-contained deploy.

3. (Medium) `--dev` install dep_selection regressed to DevNoOptional.
   The earlier dep-axis unification folded `--dev` into the install-side
   optional axis, contradicting the explicit warning at lines 252–258:
   stripping transitive optional sub-deps of devDependencies (e.g.
   optional sub-deps of `jest`) breaks dev tooling. Decouple
   `dep_selection_for_args` from `DepAxis` — the manifest strip and
   lockfile subset legitimately drop direct optionalDependencies
   under `--dev` (matches pnpm), but install's resolved-graph filter
   must not. Restore `Dev` for `--dev` alone, document the asymmetry,
   and update the matrix test.

Bundles `deployed_canonical` + `target_root` into a `DeployRoot` to
keep `rewrite_local_refs`'s arg count under clippy's 7-arg limit, and
adds three unit tests (back-ref to deploy root, file: peer error,
the corrected --dev cell).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Cursor caught the missing twin to the previous back-ref fix: the
`workspace:*` branch in `plan_injections` and `rewrite_local_refs`
both check `canonical == deployed_canonical` to avoid duplicating the
deployed package, but the `file:`/`link:` Directory/Link branches
didn't. A sibling reaching the deployed package via
`file:../deployed-pkg` (instead of `workspace:*`) would still inject a
duplicate copy under `.aube-deploy-injected/`, breaking the same
runtime singleton invariant.

Mirror the `workspace:` guards on the file:/link: branches:
- plan_injections: skip the deployed canonical path before inserting.
- rewrite_local_refs: emit `file:<rel-to-target-root>` for back-refs
  before falling through to the `plan.get` lookup.

Adds a unit test covering the file:-based back-ref shape.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>