fix(sidecar): child launchers run under plain bun, not the intx-src condition (CL-8421)

VENDORED.md

@@ -27,7 +27,7 @@ Pinned to [faremeter/interchange](https://github.com/faremeter/interchange)
 
 | Vendored path                 | What it is                                                              | Owner  | Kill date  |
 | ------------------------------ | ------------------------------------------------------------------------ | ------ | ---------- |
-| `apps/sidecar`                 | Copy of upstream's sidecar app; apps are never npm-published. One local delta: `workflow-substrate-factory.ts` registers `@corbits/credential-header`'s and `@corbits/credential-mcp`'s providers alongside `builtinCredentialProviders()` | sawyer | 2026-11-03 |
+| `apps/sidecar`                 | Copy of upstream's sidecar app; apps are never npm-published. Two local deltas: `workflow-substrate-factory.ts` registers `@corbits/credential-header`'s and `@corbits/credential-mcp`'s providers alongside `builtinCredentialProviders()`; `bin/workflow-child` and `bin/workflow-probe-child` run under plain `bun` instead of upstream's `intx-src` resolve condition | sawyer | 2026-11-03 |
 | `vendor/intx/agent`            | `@intx/agent` at a newer commit than npm has published                    | sawyer | 2026-11-03 |
 | `vendor/intx/db`                | `@intx/db`, with one local serving-time credential-refresh delta          | sawyer | 2026-11-03 |
 | `vendor/intx/harness`           | `@intx/harness` at a newer commit than npm has published                  | sawyer | 2026-11-03 |

apps/sidecar/bin/workflow-child

@@ -1,8 +1,6 @@
-#!/usr/bin/env -S bun --conditions=intx-src
-// The intx-src condition resolves @intx/* to TypeScript source. The
-// sidecar spawns this child by path (`Bun.spawn([binaryPath])`) and
-// `--conditions` is not inherited, so it is set on the shebang. The dev
-// loop builds no dist; a bundled deployment does not run this file.
+#!/usr/bin/env bun
+// Plain bun: @intx/* resolves through published packages and the
+// vendored source exports, never a resolve condition.
 import { runWorkflowChildFromProcessEnv } from "@intx/workflow-host";
 import {
   SIDECAR_SUBSTRATE_CONFIG_KEYS,

apps/sidecar/bin/workflow-probe-child

@@ -1,8 +1,6 @@
-#!/usr/bin/env -S bun --conditions=intx-src
-// One-shot workflow-probe child. The sidecar host spawns this by path
-// (`Bun.spawn([binaryPath])`); `--conditions` is not inherited, so it is
-// set on the shebang to resolve @intx/* to TypeScript source in the dev
-// loop. A bundled deployment does not run this file.
+#!/usr/bin/env bun
+// One-shot workflow-probe child, spawned by path with plain bun so
+// @intx/* resolves through published packages and vendored source.
 //
 // The child reads the materialized package dir and IPC anchors from its
 // fresh env, evaluates the workflow entry behind the airlock, and ships

apps/sidecar/src/workflow-host-wiring-spawner.test.ts

@@ -67,7 +67,7 @@ eventStream.write(event, () => {
     // path here points to a TypeScript file which requires Bun's
     // shebang to execute; the production binary at
     // `apps/sidecar/bin/workflow-child` is
-    // `#!/usr/bin/env -S bun --conditions=intx-src`, so the wiring
+    // `#!/usr/bin/env bun`, so the wiring
     // module spawns it as a bare argv entry. The
     // test mirrors that by routing the spawn through a tiny
     // wrapper script that points at Bun's runtime.