fix(plugin-cli): preserve profile extensions on publish

[ascorbic]

What does this PR do?

Fixes subsequent emdash-plugin publish calls dropping existing package-profile extensions while bumping lastUpdated.

The publish path now retains the valid keyed extensions map, including the delegated-release policy extension and unknown forward-compatible extension entries. update-package already preserved this data; its regression coverage now makes that guarantee explicit.

Related to #1908 and #1918.

Type of change

• Bug fix
• Feature (requires maintainer-approved Discussion)
• Refactor (no behavior change)
• Translation
• Documentation
• Performance improvement
• Tests
• Chore (dependencies, CI, tooling)

Checklist

• I have read CONTRIBUTING.md
• pnpm typecheck passes
• pnpm lint passes
• pnpm test passes (or targeted tests for my change)
• pnpm format has been run
• I have added/updated tests for my changes (if applicable)
• User-visible strings in the admin UI are wrapped for translation (if applicable). Do not include messages.po changes except in translation PRs — a workflow extracts catalogs on merge to main.
• I have added a changeset (if this PR changes a published package)
• New features link to an approved Discussion: https://github.com/emdash-cms/emdash/discussions/...

i18n and a new Discussion are not applicable: no admin UI is changed, and this fixes data loss introduced by the newly merged record extension contract.

AI-generated code disclosure

• This PR includes AI-generated code — model/tool: OpenCode with GPT-5.6-terra

Screenshots / test output

• pnpm build passes with existing virtual-import and deliberate test-plugin eval warnings
• Focused publish/update tests pass: 61 tests
• pnpm --filter @emdash-cms/plugin-cli typecheck passes
• pnpm lint passes with 0 warnings/errors
• Targeted formatting and git diff --check pass

[changeset-bot]

🦋 Changeset detected

Latest commit: 7292a25

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 5 packages

Name	Type
@emdash-cms/plugin-cli	Patch
@emdash-cms/perf-demo-site	Patch
@emdash-cms/cache-demo-site	Patch
@emdash-cms/do-demo-site	Patch
@emdash-cms/do-solo-demo-site	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-demo-cache	7292a25	Jul 10 2026, 03:16 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-demo-do	7292a25	Jul 10 2026, 03:17 PM

[emdashbot]

Review: LGTM

This PR fixes the right problem in the right place. After the profile record gained an extensions map for delegated-release policy and forward-compatible extension entries, the publish path's stampLastUpdated canonicaliser was re-emitting only the known scalar/profile fields and dropping extensions. The fix adds extensions to the explicit whitelist, preserving the map verbatim when a later release bumps lastUpdated.

What I checked

• Approach: The change is surgical: stampLastUpdated now carries extensions through on the applyWrites update path, matching the existing update-package spread-preservation behavior. This keeps the canonicalising step that strips stray top-level keys from earlier experimental shapes, while protecting the intentionally-open extensions container.
• Lexicon match: com.emdashcms.experimental.package.profile defines extensions as optional unknown, so preserving the keyed map passes both local and server-side validation.
• Tests: The new publish test seeds a profile with both the delegated-release extension and an unknown forward-compatible extension, runs publishRelease for a later version, and asserts the map survives. The update-package test is likewise tightened to assert extensions survive an edit. Both tests exercise the actual MockPds applyWrites/putRecord paths.
• Changeset: A patch changeset is present for @emdash-cms/plugin-cli and describes the user-visible fix.
• AGENTS.md concerns: No admin UI strings, no SQL, no route/auth/locale changes. Formatting uses tabs and the diff stays scoped to the publish/update-package boundary.

The implementation is correct and the regression coverage is appropriate. No blocking issues.