docs(llms-cli): pin @run402/astro >=1.2.1 + spell out the @run402/sdk >=2.18.0 paired requirement

Document the SDK-version dependency surfaced by Kychon's v1.2.0 re-test:
older @run402/sdk rejects FunctionSpec.class locally before any network
call. v1.2.1's preflight catches this with a precise R402_ASTRO_SDK_VERSION_TOO_OLD
error; pinning the paired version here in the agent reference is the
clearest signal.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: MajorTal

cli/llms-cli.txt

@@ -312,7 +312,7 @@ run402 deploy apply --dir ./dist --project prj_...
 run402 deploy apply --dir ./dist --manifest run402.config.json --project prj_...
 ```
 
-The CLI dynamically imports `@run402/astro/release-slice` (must be installed in the consuming project, **`>=1.2.0`** — v1.1.0 emitted a slice the gateway rejected and is deprecated). The helper bundles the SSR server output with esbuild into a single `source` (the gateway rejects multi-file function specs), emits no `/*` catchall route (the gateway routes every unmatched path to the project's `class: 'ssr'` function automatically), and colocates the `_assets-manifest.json` inside the resolved `build.client` dir (so the slice's site replace dir carries it). On a missing/incompatible manifest the error envelope carries `code: "R402_ASTRO_ADAPTER_MANIFEST_MISSING"` or `R402_ASTRO_ADAPTER_MANIFEST_VERSION_UNSUPPORTED` with `hint` + `docs` fields pointing at run402.com/errors. Direct-SDK callers get the same primitive via `import { buildAstroReleaseSlice } from "@run402/astro/release-slice"`.
+The CLI dynamically imports `@run402/astro/release-slice` (must be installed in the consuming project, **`@run402/astro >=1.2.1` + `@run402/sdk >=2.18.0`** — older SDKs reject `FunctionSpec.class: 'ssr'` locally in `validateKnownFields` before the spec ever reaches the gateway; the helper preflights this and emits `R402_ASTRO_SDK_VERSION_TOO_OLD` with a precise upgrade command). The helper bundles the SSR server output with esbuild into a single `source` (the gateway rejects multi-file function specs), emits no `/*` catchall route (the gateway routes every unmatched path to the project's `class: 'ssr'` function automatically), defaults `site.public_paths: { mode: "implicit" }` to opt out of inherited explicit-mode paths from the base release, and colocates the `_assets-manifest.json` inside the resolved `build.client` dir (so the slice's site replace dir carries it). On a missing/incompatible manifest the error envelope carries `code: "R402_ASTRO_ADAPTER_MANIFEST_MISSING"` or `R402_ASTRO_ADAPTER_MANIFEST_VERSION_UNSUPPORTED` with `hint` + `docs` fields pointing at run402.com/errors. Direct-SDK callers get the same primitive via `import { buildAstroReleaseSlice } from "@run402/astro/release-slice"`.
 
 Recovery from a stuck deploy: when an `apply` ends in `activation_pending` (rare; transient gateway failure between SQL commit and the pointer-swap activation), the gateway auto-resumes on the hourly tick. Static spec/config activation failures are classified promptly and thrown as structured deploy errors instead of polling until timeout. For genuinely resumable operations, call resume explicitly: