[ExtraToast]

Summary

Publish Fragment runs deploy-kit at a version this repository pins, so a calling repository carries its Project Intent and no package.json, lockfile or .npmrc for the toolkit (JorisJonkers-dev/deploy-kit ADR 0089, as rewritten in JorisJonkers-dev/deploy-kit#435).

• tools/deploy-kit/ pins @jorisjonkers-dev/deploy-kit at exactly 0.14.0, the version JorisJonkers-dev/estate composes with today.
• The workflow installs from that directory in its own checkout and prints the installed version as a notice. The toolkit-directory input is gone: a caller still passing it fails, but callers pin this workflow by commit, so none breaks until it bumps.
• Renovate opens a deploy-kit bump as fix(deps), so release-please cuts a release for it. It never automerges, and the PR body says to merge only once the Estate's composition pin is at that version or newer.
• Tests cover the install step and hold the pin exact and locked.

To know:

• actions/render-diff still reads the composing toolkit from TOOLKIT_DIRECTORY: that is the Estate's composition pin, which stays.
• Callers to move: Carry no deploy-kit pin delivery#50, Carry no deploy-kit pin estate-dashboard#33, Carry no deploy-kit pin auth-api#101, Carry no deploy-kit pin home-portal#78, JorisJonkers-dev/estate#79.

Part of JorisJonkers-dev/deploy-kit#195. Closes #149.