fix: mark @xmtp/node-bindings peer as optional

[insipx]

Why

convos-cli's @xmtp/node-bindings peer is type-only (import type { ContentTypeId, EncodedContent } — erased at runtime; bindings actually arrive through @xmtp/node-sdk's exact-pinned dependency). But as a required peer, pnpm's autoInstallPeers fetches a second, registry-latest bindings build in any workspace that pins bindings only via pnpm.overrides — i.e. convos-assistants, where the dev-release bump PR (xmtplabs/convos-assistants#3641) now fails its lockstep guard with two resolved bindings versions. Worse than the CI failure: the auto-installed instance is a native addon compiled against a different node-sdk than the one in the tree — exactly the sdk/bindings mismatch the lockstep checks exist to prevent. Nightly bumps only dodged this by coincidence (pinned nightly == registry-latest nightly).

What

Add peerDependenciesMeta marking @xmtp/node-bindings optional:

• optional peers are never auto-installed — the rogue fetch disappears;
• when bindings is in the graph (always, via node-sdk's exact dep), the optional peer resolves to that single instance, so the published .d.ts type imports keep working against the same bindings the workspace runs;
• the @xmtp/node-sdk peer, both ranges, and the lockstep test are unchanged.

Patch changeset included. After release, renovate's grouped bump propagates this to convos-assistants and unblocks the dev-release bump flow.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Note

Mark @xmtp/node-bindings peer dependency as optional

Adds peerDependenciesMeta in package.json to mark @xmtp/node-bindings as optional. Package managers no longer error or warn when the dependency is absent. Adds a patch changeset for @xmtp/convos-cli.

^{Macroscope summarized e45257d.}

[macroscopeapp]

Approvability

Verdict: Approved at e45257d

Macroscope's review found this PR approvable — This is a narrowly scoped package-metadata fix that prevents pnpm from auto-installing a conflicting native bindings build while retaining the required node-sdk dependency. No application logic, schemas, or sensitive infrastructure are changed.

^{You can add or adjust custom eligibility rules. Learn more.}