chore(invoice-organizer): 1.0.2 —— 重新 pin 到已合并 commit / repin to merged commit (#130)

## 背景 / Background

接 [#127](https://github.com/desirecore/market/pull/127)。那个 PR
只改了技能内容，**刻意没动版本号与 pin**——`contentSource.ref` 必须指向**已合并的 commit**，而那个
SHA 在合并前并不存在。先 bump 版本会让目录声称 1.0.2、却仍按指向 1.0.1 内容的 pin 去取文件，比不 bump 更糟。

这是 `#117`/`#118`、`#120`/`#121` 之后**第三次**走同一条两步约束——inline agent 声明为
`installable` 就必须 pin 到已存在的 commit，所以内容与 pin 永远得分两个 PR。

Third time through the same two-step constraint: an inline agent
declared `installable` must pin to an already-merged commit, so content
and pin can never land in one PR.

## 改动 / Changes

- `agent.json#contentSource.ref`、sidecar 的 `provenance.content.ref` 与
`governance.compliance.reviewedRef` **三处同步** pin 到 `406bc10`
- 版本 `1.0.1` → `1.0.2`（`agent.json` 与 sidecar `release.version` 两处一致）
- `reviewedAt` / `timestamps.reviewedAt` 同步到 `2026-09-06`
- 补 1.0.2 changelog（中英双语）

## 1.0.2 修了什么 / What 1.0.2 fixes

两条都来自真机对比两个版本产出的索引文件：

| 缺陷 | 现象 | 危害 |
| --- | --- | --- |
| 索引顶层结构没钉死 | 同一个 Agent 分别产出过 `{…, records:[…]}`（数组）与 `{…, invoices:{…},
suspectedDuplicates, quarantined}`（字典），`updatedAt` 也时有时无 |
台账、报告、幂等判据全部从索引派生，键名一漂，跨轮次和外部工具都对不上 |
| `emails.json` 的 key 有前缀歧义 | key 是 `<provider>:<email>:<mailId>`，而 IMAP
的 `mailId` 自带 `imap:` 前缀 → `imap:me@example.com:imap:123` | 服务端对裸 UID
也接受，所以某轮抄原值、某轮剥前缀，**同一封邮件产生两个 key，「已处理」判定失效、邮件被重复入账** |

两条的修法都是**只钉规则、不改语义**：旧形态原样沿用、不重写容器；key
用列表接口返回的原值、一个字符不改。因此**对任何已落盘的索引文件零影响**——改语义会让存量用户的已处理邮件全部失配、整个邮箱重新入账一遍。

Both fixes pin the rule without changing semantics, so existing on-disk
index files are unaffected.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

agents/invoice-organizer/agent.json

@@ -17,8 +17,8 @@
     "finance",
     "email"
   ],
-  "version": "1.0.1",
-  "updatedAt": "2026-09-04",
+  "version": "1.0.2",
+  "updatedAt": "2026-09-06",
   "maintainer": {
     "name": "DesireCore Official",
     "verified": true
@@ -124,6 +124,20 @@
     "tools": []
   },
   "changelog": [
+    {
+      "version": "1.0.2",
+      "date": "2026-09-06",
+      "changes": {
+        "zh-CN": [
+          "钉死 .index/ 三个索引文件的顶层结构（ledger/files/emails 的容器键名与嵌套形态），并规定读到旧形态时原样沿用、不重写容器",
+          "钉死 emails.json 的 key 用列表接口返回的 mailId 原值——IMAP 的 id 自带 imap: 前缀，双前缀是正确形态，剥掉会让同一封邮件产生两个 key 而重复入账"
+        ],
+        "en-US": [
+          "Pin the top-level schema of the three .index files (container keys and nesting for ledger/files/emails); legacy shapes are read and preserved in place rather than rewritten",
+          "Pin the emails.json key to the verbatim mailId returned by the list API — IMAP ids already carry an imap: prefix, so the doubled prefix is correct; stripping it yields two keys for one message and double-counts it"
+        ]
+      }
+    },
     {
       "version": "1.0.1",
       "date": "2026-09-04",
@@ -161,6 +175,6 @@
     "kind": "git",
     "repoUrl": "https://github.com/desirecore/market.git",
     "path": "agents/invoice-organizer",
-    "ref": "7560a586426f5575eb86b0de0498f9b5cebe1751"
+    "ref": "406bc10bccddd8b57436bc7035f065b2c327a286"
   }
 }

agents/invoice-organizer/catalog-metadata.v1.json

@@ -30,23 +30,23 @@
   },
   "release": {
     "state": "known",
-    "version": "1.0.1",
+    "version": "1.0.2",
     "versionScheme": "semver"
   },
   "timestamps": {
     "catalogUpdatedAt": {
       "state": "known",
-      "value": "2026-09-04",
+      "value": "2026-09-06",
       "precision": "day"
     },
     "releasePublishedAt": {
       "state": "known",
-      "value": "2026-09-04",
+      "value": "2026-09-06",
       "precision": "day"
     },
     "reviewedAt": {
       "state": "known",
-      "value": "2026-09-04",
+      "value": "2026-09-06",
       "precision": "day"
     },
     "upstreamObservedAt": {
@@ -58,7 +58,7 @@
       "kind": "git",
       "url": "https://github.com/desirecore/market.git",
       "path": "agents/invoice-organizer",
-      "ref": "7560a586426f5575eb86b0de0498f9b5cebe1751"
+      "ref": "406bc10bccddd8b57436bc7035f065b2c327a286"
     }
   },
   "governance": {
@@ -75,8 +75,8 @@
     },
     "compliance": {
       "licenseEvidencePath": "LICENSE",
-      "reviewedRef": "7560a586426f5575eb86b0de0498f9b5cebe1751",
-      "reviewedAt": "2026-09-04",
+      "reviewedRef": "406bc10bccddd8b57436bc7035f065b2c327a286",
+      "reviewedAt": "2026-09-06",
       "reviewedBy": "yi-ge",
       "upstreamEndorsed": true
     }