Reconcile #15: restore v0.3.1 identity, CAS backends as optional deps, fix daemon gating (unbreak main CI)

[bdelanghe]

Why

main CI is red and a stray v0.0.1 "Latest" release exists — both fallout from
#15 ("Add package.json: declare prose deps"). That commit's message only mentions
declaring the prose deps, but it also rewrote package.json to:

• reset version 0.3.0 → 0.0.1 + add "private": true,
• drop cas / anchored-chain from deps (and scripts / license).

Fallout:

1. The version reset tripped release.yml → it cut a string-audit v0.0.1 GitHub
   release, now marked Latest, sitting below the real v0.3.0.
2. With the deps gone, npm ci installs only the 9 prose packages, so the socket-store
   CI step crashes (Cannot find package '@bounded-systems/cas'). Combined with the
   pre-existing store: lazy-load cas/anchored-chain (fix standalone offline run) #13 daemon-gating bug (generateEd25519Keypair is not a function), the
   pipeline is red.
3. package-lock.json was left out of sync with package.json (root version 0.1.0,
   cas still under regular deps).

What this PR does

Restore the 0.3.x package identity (per maintainer decision — the 0.0.1/private reset
was unintended): version 0.3.1, full description, bin, scripts, license; drop
private: true.

Bring cas/anchored-chain back as optionalDependencies (per maintainer decision):

• default node audit.mjs (FsStore) + the whole prose path stay JSR-free — Add package.json (declare prose deps) #15's intent;
• the STORE=cas / socket-store backings install on demand.

Fix the daemon-gating bug (store.mjs / store-daemon.mjs): load the cas/anchored-chain
backends when a CasStore is constructed (new async makeCasStore factory) rather than
gating on the STORE env — the daemon builds a CasStore with no STORE set, so the
env gate never loaded them.

ci.yml: npm ci --omit=optional proves the JSR-free core, then a dedicated
Install optional CAS backends step runs before the socket-store test — so npm.jsr.io
flakiness can only affect that one step, never the default pipeline.

package-lock.json regenerated in sync (root 0.3.1; optional entries carry
resolved + integrity + optional:true; anchored-chain 0.2.1 → 0.2.2, within ^0.2.1).

README Status → v0.3.1; notes the Vale gate (#6/#12) + optional CAS backings.

On merge, release.yml sees version 0.3.1 and cuts v0.3.1 (Thread 1). The stray
v0.0.1 tag + release will be deleted after this merges (once the version is no longer
0.0.1, so release.yml can't recreate it).

Test — full ci.yml sequence locally (Node 24)

npm ci --omit=optional   → 9 packages, cas NOT installed (JSR-free core ✓)
node test.mjs            ✓   node audit.mjs ✓   cache invariant (0 miss) ✓   extract ✓
npm install --include=optional → +3 packages, cas installed ✓
socket store: daemon mounts · cold · warm 0 miss ✓   (exercises anchored-chain 0.2.2 signing API)

Also re-verified the invariant: with cas/anchored-chain moved aside, the default
node audit.mjs still runs (default path imports neither).

Supersedes #14 (v0.3.1 bump, written against the pre-#15 package.json) and #16 (the store
fix alone, which is insufficient now that #15 removed the deps) — both closed.

PR run sheet

1. Independent PR — one goal: undo the Add package.json (declare prose deps) #15 regression and ship v0.3.1 green. The
   store fix, deps, lockfile, and ci.yml are interdependent for a green socket-store step,
   so they land together (neither passes CI alone).
2. Changed codepaths verified — full ci.yml sequence + the absent-deps invariant, locally.
3. Root cause identified — Add package.json (declare prose deps) #15's package.json rewrite (version reset + deps removal)
   and the store: lazy-load cas/anchored-chain (fix standalone offline run) #13 env-gated lazy import vs. the daemon's env-less CasStore construction.
4. No duplication — single makeCasStore factory; both construction sites route through it.
5. No unrelated changes — untracked RELEASE-v0.3.0.md left out.

🤖 Generated with Claude Code