Problem

Cherry-pick #2402 added @aws-sdk/client-s3@3.1000.0 and @aws-sdk/s3-request-presigner@3.1000.0 to extensions/tlon/package.json (replacing the removed @tloncorp/api git dep) but did not mirror them in root package.json. pnpm release:check enforces that bundled-extension deps must exist in root (or sit in the extension's rootDependencyMirrorAllowlist).

Result: publish-next job fails on every push to main since 2026-04-18 21:24 UTC (commit f4c70a29). The next npm channel is not being updated.

Error from latest failed run (24614211935):

release-check: bundled extension root dependency mirror validation failed:
  - bundled extension 'tlon' root dependency mirror drift |
    missing in root package: @aws-sdk/client-s3, @aws-sdk/s3-request-presigner |
    new gaps: @aws-sdk/client-s3, @aws-sdk/s3-request-presigner

Scope

• Add @aws-sdk/client-s3@3.1000.0 and @aws-sdk/s3-request-presigner@3.1000.0 to root package.json dependencies (alphabetical order).
• Run pnpm install to regenerate pnpm-lock.yaml.
• Verify locally: pnpm release:check exits 0.

Acceptance Criteria

• Root package.json dependencies contains both @aws-sdk/client-s3@3.1000.0 and @aws-sdk/s3-request-presigner@3.1000.0.
• pnpm install succeeds; pnpm-lock.yaml updated and committed.
• pnpm release:check exits 0 locally.
• Post-merge publish-next run on the merge commit passes (verifies the gap is closed end-to-end).

References

• Latest failed run: https://github.com/remoteclaw/remoteclaw/actions/runs/24614211935
• Cherry-pick that introduced the gap: f4c70a2 (fix(ci): replace tlon git api dependency (closes #2362) #2402)
• Precedent fixes for the same class: fix: mirror new bundled extension deps to root — unblock publish-next #2361, fix(extensions): clear stale release-check mirror allowlists + drop gutted pi-agent-core from matrix #2384, fix(ci): B9-post revert extension versions + clear stale allowlists #2399
• Enforcement: scripts/release-check.ts → checkBundledExtensionRootDependencyMirrors

Commit format

fix(deps): mirror tlon @aws-sdk/* deps to root — unblock publish-next