⬆️ Pin CI to Deno 2.9.5 for the esbuild bundle deadlock fix (#359)

Every workflow pinned an exact `deno-version: v2.9.1`, so the fix for the
`deno bundle` ↔ esbuild deadlock could not arrive on its own. That wedge —
both processes at 0% CPU forever, never self-recovering — was filed upstream
as denoland/deno#36417 and fixed by denoland/esbuild_client#18, which moves
ping/on-start response handling off the packet-dispatch path. Deno picked the
dependency up in denoland/deno#36427 and shipped it in v2.9.5, whose notes
name `fix(bundle): avoid esbuild protocol deadlock (#36427)`.

`publish-packages.yml` is generated, and CI verifies it is in sync, so the
pin moves in `scripts/gen-publish-workflow.md` and the workflow is
regenerated rather than hand-edited.

Verified against a 2.9.5 binary rather than assumed:

- `packages/cli/tests/agent-cli.test.ts` passes all 7 steps in 26s. This one
  mattered: under 2.9.4 it hung on every step, because `deno run` stalled
  given a scrubbed env plus a fresh HOME and the test spawns a literal
  `deno` from PATH. That minimal case now returns in 0.02s.
- `deno bundle` itself bundles 2469 modules in 762ms — the deadlock path,
  exercised directly.
- lint, check, test (363 passed / 0 failed) and check:jsr are all green.

The per-command deadline and the composability backstop live on the unmerged
#279 branch and are untouched here.

Co-authored-by: Taras Mankovski <74687+taras@users.noreply.github.com>

Author: taras

.github/workflows/ci.yml

@@ -30,7 +30,7 @@ jobs:
 
       - uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3
         with:
-          deno-version: v2.9.1
+          deno-version: v2.9.5
 
       - name: Typecheck
         run: deno task check
@@ -63,7 +63,7 @@ jobs:
 
       - uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3
         with:
-          deno-version: v2.9.1
+          deno-version: v2.9.5
 
       - name: Install dependencies
         run: deno task deps
@@ -84,7 +84,7 @@ jobs:
 
       - uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3
         with:
-          deno-version: v2.9.1
+          deno-version: v2.9.5
 
       - name: Install dependencies
         run: deno task deps
@@ -260,7 +260,7 @@ jobs:
 
       - uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3
         with:
-          deno-version: v2.9.1
+          deno-version: v2.9.5
 
       # Caches the harness's own graph, so it can run --cached-only below.
       - name: Prepare this checkout
@@ -279,7 +279,7 @@ jobs:
 
       - uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3
         with:
-          deno-version: v2.9.1
+          deno-version: v2.9.5
 
       - name: Install workspace deps
         run: deno install
@@ -316,7 +316,7 @@ jobs:
       # node_modules so it survives.
       - uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3
         with:
-          deno-version: v2.9.1
+          deno-version: v2.9.5
 
       - name: Install dependencies
         run: deno task deps

.github/workflows/deploy.yml

@@ -27,7 +27,7 @@ jobs:
 
       - uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3
         with:
-          deno-version: v2.9.1
+          deno-version: v2.9.5
 
       - name: Install workspace deps
         run: deno install

.github/workflows/main-health.yml

@@ -39,7 +39,7 @@ jobs:
 
       - uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3
         with:
-          deno-version: v2.9.1
+          deno-version: v2.9.5
 
       - name: Reconcile the report against main's authoritative CI state
         env:

.github/workflows/publish-one.yml

@@ -38,7 +38,7 @@ jobs:
 
       - uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3
         with:
-          deno-version: v2.9.1
+          deno-version: v2.9.5
 
       # Node 24 ships npm >= 11.5, required for OIDC trusted publishing to npm.
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4

.github/workflows/publish-packages.yml

@@ -142,7 +142,7 @@ jobs:
 
       - uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3
         with:
-          deno-version: v2.9.1
+          deno-version: v2.9.5
 
       # A build installs nothing, so a fresh checkout prepares first (spec §8).
       - name: Install dependencies

.github/workflows/release.yml

@@ -68,7 +68,7 @@ jobs:
 
       - uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3
         with:
-          deno-version: v2.9.1
+          deno-version: v2.9.5
 
       # `deno compile` embeds the generated browser bundle by following the
       # literal dynamic import, and compiles without complaint when the file is

scripts/gen-publish-workflow.md

@@ -145,7 +145,7 @@ npm stays per-package in `publish-one.yml`, and this job runs in the same
 
       - uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3
         with:
-          deno-version: v2.9.1
+          deno-version: v2.9.5
 
       # A build installs nothing, so a fresh checkout prepares first (spec §8).
       - name: Install dependencies