Phase 4: drop /v1/bundles GET endpoints (≥6 months after deprecation headers)

[mgoldsborough]

Final cleanup. Once Phase 2 (#101) and Phase 3 (#102) are complete and the deprecation window has elapsed (≥6 months from the date Deprecation: true headers shipped, per the spec), remove the legacy /v1/bundles/... GET routes.

What gets removed

apps/registry/src/routes/v1/bundles.ts GET handlers:

• GET /v1/bundles/search
• GET /v1/bundles/@:scope/:package
• GET /v1/bundles/@:scope/:package/versions
• GET /v1/bundles/@:scope/:package/versions/:version
• GET /v1/bundles/@:scope/:package/versions/:version/download
• GET /v1/bundles/@:scope/:package/index.json

The deprecation headers + onSend hook in apps/registry/src/index.ts go with them.

What stays

• POST /v1/bundles/announce — the OIDC publish path. Still inbound, not deprecated by this work. May be renamed to /v1/servers/announce in a separate cleanup, but not blocked on this issue.
• GET /v1/skills/... — unrelated, separate deprecation lifecycle.
• Legacy repository methods (findPackagesWithServerJson, findPackageWithServerJsonByName) — already removed in feat(registry): compose ServerDetail from manifest, mount /v1/servers #100 follow-up cleanup if they're dead by then.

Sequencing checklist before scheduling the removal

• Phase 2: close the gaps that block /v1/bundles deprecation #101 (Phase 2) merged + deployed
• Phase 3: cut SDK 1.0.0 with legacy bundle methods routed through /v1/servers #102 (Phase 3) merged + SDK 1.0.0 published
• mpak's own apps/web and packages/cli no longer call any legacy bundle methods
• NimbleBrain platform (nimblebrain/code) on @nimblebrain/mpak-sdk@^1.0.0
• At least 6 months elapsed since feat(registry): compose ServerDetail from manifest, mount /v1/servers #100 shipped the deprecation headers
• Access-log audit shows < 1% of total /v1/... traffic still hits /v1/bundles/... GET routes (telemetry hook needed before this audit can run — flag if not in place)
• CHANGELOG entry + breaking-change note

Definition of done

• Legacy GET handlers + onSend deprecation hook removed
• OpenAPI / Swagger no longer advertises the routes
• Integration tests covering the legacy routes deleted
• Migration guide in apps/docs updated to mark the deprecation window closed

Blocked by

• Phase 2: close the gaps that block /v1/bundles deprecation #101 (Phase 2)
• Phase 3: cut SDK 1.0.0 with legacy bundle methods routed through /v1/servers #102 (Phase 3)