fix(release): sync the packed-consumer age-gate exemptions with .npmrc

`verify:runtime-package` packs the runtime and installs it in a temp dir
under `os.tmpdir()`. That directory never inherits the repo-root `.npmrc`,
so the script writes its own `minimumReleaseAgeExclude` from
`RELEASE_AGE_EXCLUDE` — a second copy of the same policy.

#7093 added `@ag-ui/mcp-middleware` and `@ag-ui/mcp-apps-middleware` to
`.npmrc` but not to that list, so the freshly published
`@ag-ui/mcp-middleware@0.0.2` installed everywhere except inside the packed
-runtime verification, which failed with:

    ERR_PNPM_NO_MATURE_MATCHING_VERSION  Version 0.0.2 (released 22 minutes
    ago) of @ag-ui/mcp-middleware does not meet the minimumReleaseAge
    constraint

The list's own comment already said to keep it in sync with `.npmrc`. A
comment was the only thing holding the two together, and it did not hold,
so this also adds a test asserting the two lists are identical. The test
was mutation-checked in both directions: dropping an entry from either
file fails it.

Verified by running the failing step: `pnpm run verify:runtime-package`
now exits 0 with "OK: packed runtime installs
@copilotkit/channels-intelligence and loads through ESM and CJS".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/release/lib/channels-umbrella.test.ts

@@ -1,3 +1,6 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { describe, expect, it } from "vitest";
 import {
   ADAPTERS,
@@ -162,4 +165,29 @@ describe("createConsumerWorkspaceYaml", () => {
     // whole scope.
     expect(RELEASE_AGE_EXCLUDE).not.toContain("@ag-ui/*");
   });
+
+  // The packed-consumer install runs in a temp dir, which never inherits the
+  // repo-root `.npmrc`, so this list is a second copy of the same policy. The
+  // two drifted once: `@ag-ui/mcp-middleware` was added to `.npmrc` alone, and
+  // a fresh publish then failed the age gate only inside the packed-runtime
+  // verification. Keep them identical.
+  it("matches the age-gate exemptions in the repo-root .npmrc", () => {
+    const root = join(
+      dirname(fileURLToPath(import.meta.url)),
+      "..",
+      "..",
+      "..",
+    );
+    const npmrc = readFileSync(join(root, ".npmrc"), "utf8");
+    const fromNpmrc = npmrc
+      .split("\n")
+      .map((line) => line.trim())
+      .filter((line) => line.startsWith("minimum-release-age-exclude[]="))
+      .map((line) =>
+        line.slice("minimum-release-age-exclude[]=".length).trim(),
+      );
+
+    expect(fromNpmrc.length).toBeGreaterThan(0);
+    expect([...fromNpmrc].sort()).toEqual([...RELEASE_AGE_EXCLUDE].sort());
+  });
 });

scripts/release/lib/channels-umbrella.ts

@@ -53,6 +53,8 @@ export const RELEASE_AGE_EXCLUDE = [
   "@ag-ui/langgraph",
   "@ag-ui/a2ui-middleware",
   "@ag-ui/a2ui-toolkit",
+  "@ag-ui/mcp-middleware",
+  "@ag-ui/mcp-apps-middleware",
 ] as const;
 
 export function createConsumerWorkspaceYaml(): string {