fix: harden beta onboarding and Next.js isolation

[captain-jack-sparrow909]

Summary

• Route every copyable prerelease command through bugbonsai@beta.
• Pin generated recipient verification commands to the exact producing BugBonsai version.
• Materialize dependency snapshots inside disposable candidates for detected Next.js projects so Turbopack resolves next within the isolated project root.
• Add a source-independent regression test for the Next.js realpath invariant.
• Update beta.3 issue templates, launch state, field evidence, and measurable promotion gates.

Why

npm's bootstrap-created latest tag still points to 0.1.0-beta.0, while beta points to 0.1.0-beta.3. Unqualified onboarding therefore installs an outdated build. Generated reproductions should be stricter: recipients now verify with the same BugBonsai version that produced the manifest.

Real-world dogfooding against vercel/next.js#97378 also found that beta.3's symlinked dependency snapshot escaped the isolated candidate root. Next.js 16.3.1/Turbopack then replaced the intended failure with Could not find the Next.js package. Detected Next.js projects now receive a materialized snapshot while other adapters keep the faster linked path.

Verification

• pnpm release:check
• 29 test files / 103 tests
• Compatibility corpus and benchmark budgets passed
• Packed-consumer verification passed
• Pinned public Next.js/Turbopack case preserved the intended failure 2 times before reduction and 3 times afterward
• Field run reduced 8 project files / 35.6 KB to 4 files / 32.3 KB across 15 candidate executions
• User-visible change includes a Changeset

The public Next.js run used --no-install, so it is engine field evidence rather than a recipient-portability or support claim.

Promotion policy

Promotion to latest remains blocked until the documented external-observation, real-project verification, ecosystem, regression-corpus, safety, cross-platform CI, package, and release-review gates are all satisfied.