fix(kirocrew): pin 0.5.0 and preserve managed restarts

packs/kirocrew/install.sh

@@ -29,7 +29,7 @@ PACK_ARG_REGION="$(pack_config_get region "us-east-1")"
 PACK_ARG_FROM_SECRET="$(pack_config_get from-secret "")"
 PACK_ARG_API_KEY="$(pack_config_get kiro-api-key "")"
 PACK_ARG_CHANNEL="$(pack_config_get channel "stable")"
-PACK_ARG_KIROCREW_VERSION="$(pack_config_get kirocrew-version "0.3.0")"
+PACK_ARG_KIROCREW_VERSION="$(pack_config_get kirocrew-version "0.5.0")"
 PACK_ARG_EXTRAS="$(pack_config_get extras "aws,voice")"
 PACK_ARG_GATEWAY_PORT="$(pack_config_get gateway-port "5476")"
 PACK_ARG_START_GATEWAY="$(pack_config_get start-gateway "true")"
@@ -53,12 +53,14 @@ Options:
   --from-secret        Secrets Manager id/arn for Kiro API key      [default: ""]
   --channel            KiroCrew release channel                     [default: stable]
                        (stable | nightly | insider)
-  --kirocrew-version   Pin KiroCrew version                         [default: 0.3.0]
+  --kirocrew-version   Pin KiroCrew version                         [default: 0.5.0]
                        Channel and version BOTH form the download path
                        (cli/<channel>/<version>/cli-manifest.json), so they
-                       must be compatible. 0.3.0 was cut on the stable lane
-                       only: changing --channel without also passing a version
-                       that exists on that lane 403s and fails the install.
+                       must be compatible. This is the published ARTIFACT
+                       version, verified independently of the GitHub tag.
+                       Before changing either value, confirm that the lane's
+                       feed/<channel>/latest-cli.json, manifest, and wheel all
+                       publish the exact version.
   --extras             Comma-separated pip extras (aws,voice)       [default: aws,voice]
   --gateway-port       KiroCrew gateway port                        [default: 5476]
   --start-gateway      Enable systemd service (true|false)          [default: true]

packs/kirocrew/manifest.yaml

@@ -25,8 +25,8 @@ params:
     description: "KiroCrew release channel (stable | nightly | insider)"
     default: "stable"
   - name: kirocrew-version
-    description: "KiroCrew version passed to the upstream installer as --version. Pinned by default; an empty value does NOT float to the channel's latest, because pack_config_get falls back to the pinned default whenever the configured value is empty. Must be compatible with the channel: both values form the manifest path cli/<channel>/<version>/cli-manifest.json, and an unmatched pair (e.g. insider/0.3.0) returns 403 and fails the install."
-    default: "0.3.0"
+    description: "KiroCrew version passed to the upstream installer as --version. Pinned by default; an empty value does NOT float to the channel's latest, because pack_config_get falls back to the pinned default whenever the configured value is empty. This is the published ARTIFACT version, verified independently of the GitHub release tag. It must match the channel because both values form cli/<channel>/<version>/cli-manifest.json; before changing the pin, confirm that feed/<channel>/latest-cli.json, the manifest, and its wheel URL all publish the exact version."
+    default: "0.5.0"
   - name: extras
     description: "Comma-separated pip extras to install after wheel (voice, aws)"
     default: "aws,voice"

packs/kirocrew/resources/kirocrew-gateway.service

@@ -36,3 +36,8 @@ PrivateTmp=true
 
 [Install]
 WantedBy=multi-user.target
+# KiroCrew 0.5 service control looks for kirocrew.service. Keep LowKey's legacy
+# unit name for existing automation while exposing the canonical service alias,
+# so `kirocrew restart` restarts this 0.0.0.0-bound managed gateway instead of
+# replacing it with an unmanaged loopback-only process.
+Alias=kirocrew.service

packs/kirocrew/test.sh

@@ -186,6 +186,35 @@ else
   fail "install.sh --help does not exit 0"
 fi
 
+# ── version pin consistency ──────────────────────────────────────────────────
+# The pinned KiroCrew version is stated in three independent places. They drift
+# silently on a version bump, and a stale help/manifest value misleads operators
+# into passing a channel/version pair that was never published (403 install).
+header "version pin consistency"
+
+PIN_MANIFEST="$(python3 -c "
+import yaml
+d = yaml.safe_load(open('${MANIFEST}'))
+print(next(p['default'] for p in d.get('params', []) if p['name'] == 'kirocrew-version'))
+" 2>/dev/null || true)"
+
+PIN_CODE="$(sed -n 's/.*pack_config_get kirocrew-version "\([^"]*\)".*/\1/p' "${INSTALL}" | head -1)"
+
+PIN_HELP="$(bash "${INSTALL}" --help 2>/dev/null \
+  | sed -n 's/.*--kirocrew-version .*\[default: \([^]]*\)\].*/\1/p' | head -1)"
+
+if [[ -n "${PIN_MANIFEST}" && -n "${PIN_CODE}" && -n "${PIN_HELP}" ]]; then
+  pass "pinned version is discoverable in manifest, code, and help"
+else
+  fail "could not extract pin (manifest='${PIN_MANIFEST}' code='${PIN_CODE}' help='${PIN_HELP}')"
+fi
+
+if [[ "${PIN_MANIFEST}" == "${PIN_CODE}" && "${PIN_CODE}" == "${PIN_HELP}" ]]; then
+  pass "pin agrees across manifest, code fallback, and help (${PIN_CODE})"
+else
+  fail "pin disagrees: manifest='${PIN_MANIFEST}' code='${PIN_CODE}' help='${PIN_HELP}'"
+fi
+
 # ── arg parser exit codes ────────────────────────────────────────────────────
 header "arg parser exit codes"
 
@@ -427,6 +456,12 @@ else
   fail "unit ReadWritePaths too narrow (should cover ~/.kiro)"
 fi
 
+if grep -Fxq 'Alias=kirocrew.service' "${UNIT}"; then
+  pass "unit exposes canonical kirocrew.service alias for service-aware restart"
+else
+  fail "unit missing kirocrew.service alias; kirocrew restart would bypass systemd"
+fi
+
 # ── Registry consistency ─────────────────────────────────────────────────────
 header "registry consistency"