fix: publish the merged bot-coverage expansion as 0.10.0

[Gdewilde]

The published package is missing 22 of 43 bot patterns

AI_BOT_PATTERN was expanded in bb8dbbe (merged 2026-04-28), but the version was last bumped in 749d275 on 2026-04-26. release.yml only fires on a package.json version change, so the expansion never published. main and npm 0.9.0 share a version number and differ in content.

Missing from the published build:

Applebot, Claude-SearchBot, Claude-Web, Google-CloudVertexBot, Google-Agent,
GoogleAgent-Mariner, Gemini-Deep-Research, cohere, Amzn-SearchBot, NovaAct,
AzureAI-SearchBot, meta-externalfetcher, meta-webindexer, DeepSeek, PanguBot,
Webzio-Extended, omgili, Timpibot, Grok, Manus-User, quillbot, MyCentralAIScraperBot

Every one of these currently lands in production as is_ai_bot: false / ua_category: other, so the traffic drops out of any AI-filtered insight.

Confirmed against production data

~120 days of agent_visit events across apideck.com:

UA	events	bot_name	is_ai_bot
…Safari/605.1.15 (Applebot/0.1; …)	11,286	Apple	false ❌
…(compatible; Applebot/0.1; …)	1,066	Apple	false ❌
…(compatible; Applebot-Extended/0.1; …)	2,552	Apple	true ✅

Only Applebot-Extended is in the published pattern, so bare Applebot — which is the majority of Apple's crawl — is invisible. The AI numbers on every dashboard are undercounts, and the undercount is uneven per vendor.

The class of bug, not just this instance

parseBotName and AI_BOT_PATTERN are two independently-maintained lists of the same bots. When they drift, a crawler gets a friendly bot_name while silently staying out of is_ai_bot — the failure is invisible, because the event still looks well-formed.

This PR pins the invariant both ways:

• Every UA parseBotName maps to an AI vendor must match AI_BOT_PATTERN — 26 real UA strings, including the full-Safari-UA shape Apple actually sends (token appended at the end), which is what slipped through.
• SEO / monitoring / classic-search crawlers must NOT be declared-crawler — Ahrefs, Semrush, Majestic, DataForSEO, bingbot, PetalBot, Yandex, Baiduspider. These get friendly labels too and must stay out of AI charts.

Tests: 161 → 187, all passing. The new suite fails against published 0.9.0.

Merging this

release.yml picks up the 0.10.0 bump on merge, cuts the tag and release, and dispatches publish.yml. No manual step.

Consumers on ^0.9.0 (website, developer-docs) need a follow-up bump to ^0.10.0 — caret on 0.x won't cross the minor.

🤖 Generated with Claude Code

[Gdewilde]

Follow-up completed, and superseded.

This PR noted that consumers on ^0.9.0 would need a bump to ^0.10.0. That happened — and 0.11.0 published shortly after, so all four consumer PRs went straight to ^0.11.0 rather than stopping at 0.10.0:

• apideck-io/website#956
• apideck-io/developer-docs#865
• chore(deps): bump @apideck/agent-analytics to ^0.11.0 agent-analytics-nextjs-starter#3
• not-a-bank/open-banking-tracker-app#226

The root cause this PR fixed — a src/ change merging without a version bump, so release.yml never fires — is still open. The regression test added here catches AI_BOT_PATTERN / parseBotName drift, but nothing catches "merged to main, never released". A CI check failing any PR that touches src/ without a version bump would close it properly.