Prepare Colony companion payload for npm release (#450)

v7.0.40 has a GitHub release but no npm registry package, so this bumps the package to the next fresh patch and records release notes for the Colony companion payload.

Constraint: npm registry has no @imdeadpool/guardex@7.0.40 while GitHub release v7.0.40 already exists

Rejected: Reuse 7.0.40 | tag and release collision would not satisfy the new release request

Confidence: high

Scope-risk: narrow

Directive: Keep release notes aligned with package version before publish

Tested: node --test --test-name-pattern companion setup slice test/setup.test.js; node --test test/status.test.js; node --check bin/multiagent-safety.js; npm pack --dry-run; openspec validate --specs; git diff --check

Not-tested: Full node --test test/setup.test.js has pre-existing managed AGENTS wording and dirty-worktree reuse failures unrelated to this release metadata change

Co-authored-by: NagyVikt <nagy.viktordp@gmail.com>

Author: NagyVikt

README.md

@@ -265,6 +265,15 @@ Being honest about where this still has issues:
 <details open>
 <summary><strong>v7.x</strong></summary>
 
+### v7.0.41
+- Bumped `@imdeadpool/guardex` from `7.0.40` to `7.0.41` so the current
+  `main` payload can publish under a fresh npm version after the `v7.0.40`
+  GitHub release landed without a matching npm registry package.
+- Ships the Colony companion setup as the default global companion surface:
+  `colony` maps to `@imdeadpool/colony-cli`, README setup documents
+  `colony install --ide ...`, and status tests/images expect Colony instead
+  of cavemem.
+
 ### v7.0.40
 - Bumped `@imdeadpool/guardex` from `7.0.39` to `7.0.40` so the current
   `main` payload can publish under a fresh npm version after `7.0.39` reached

openspec/changes/agent-codex-bump-guardex-to-7-0-41-release-2026-04-28-20-56/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-04-28

openspec/changes/agent-codex-bump-guardex-to-7-0-41-release-2026-04-28-20-56/notes.md

@@ -0,0 +1,38 @@
+# agent-codex-bump-guardex-to-7-0-41-release-2026-04-28-20-56 (minimal / T1)
+
+Branch: `agent/codex/bump-guardex-to-7-0-41-release-2026-04-28-20-56`
+
+Bump `@imdeadpool/guardex` to `7.0.41` and cut a matching GitHub release so
+the Colony companion payload from `main` has a fresh npm version available for
+manual `npm publish`.
+
+Scope:
+- Bump `package.json` and `package-lock.json` from `7.0.40` to `7.0.41`.
+- Add a `README.md` release note for `v7.0.41` describing the npm version
+  reason and Colony companion payload.
+- Verify the package tarball before finish so the maintainer can run
+  `npm publish --access public` from the merged release commit.
+
+Verification:
+- `node --test --test-name-pattern "setup (skips global install when companion npm tools are already installed|installs only missing global tools|warns when user declines oh-my-claudecode dependency install|installs missing local companion tools with explicit approval|warns when gh dependency is missing)" test/setup.test.js`
+- `node --test test/status.test.js`
+- `node --check bin/multiagent-safety.js`
+- `npm pack --dry-run`
+- `openspec validate --specs`
+- `git diff --check`
+
+Known baseline:
+- Full `node --test test/setup.test.js` currently fails outside this release diff
+  on managed AGENTS wording and dirty-worktree reuse assertions. The focused
+  companion setup slice above passed 5/5.
+
+## Handoff
+
+- Handoff: change=`agent-codex-bump-guardex-to-7-0-41-release-2026-04-28-20-56`; branch=`agent/codex/bump-guardex-to-7-0-41-release-2026-04-28-20-56`; scope=`package.json, package-lock.json, README.md, openspec/changes/agent-codex-bump-guardex-to-7-0-41-release-2026-04-28-20-56/*`; action=`finish this sandbox via PR merge + cleanup after targeted verification`.
+- Copy prompt: Continue `agent-codex-bump-guardex-to-7-0-41-release-2026-04-28-20-56` on branch `agent/codex/bump-guardex-to-7-0-41-release-2026-04-28-20-56`. Work inside the existing sandbox, review `openspec/changes/agent-codex-bump-guardex-to-7-0-41-release-2026-04-28-20-56/notes.md`, continue from the current state instead of creating a new sandbox, and when the work is done run `gx branch finish --branch agent/codex/bump-guardex-to-7-0-41-release-2026-04-28-20-56 --base main --via-pr --wait-for-merge --cleanup`.
+
+## Cleanup
+
+- [ ] Run: `gx branch finish --branch agent/codex/bump-guardex-to-7-0-41-release-2026-04-28-20-56 --base main --via-pr --wait-for-merge --cleanup`
+- [ ] Record PR URL + `MERGED` state in the completion handoff.
+- [ ] Confirm sandbox worktree is gone (`git worktree list`, `git branch -a`).

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@imdeadpool/guardex",
-  "version": "7.0.40",
+  "version": "7.0.41",
   "description": "Guardian T-Rex for your multi-agent repo. Isolated worktrees, file locks, and PR-only merges stop parallel Codex & Claude agents from overwriting each other's work. Auto-wires Oh My Codex, Oh My Claude, OpenSpec, and Caveman.",
   "license": "MIT",
   "preferGlobal": true,