[smiggleworth]

Scope

• Move all 17 consumed AskrJS dependencies to >=0.5.0 <0.6.0 and regenerate the lockfile from an isolated manifest-only copy against the reviewed candidate registry. The lock retains canonical npm URLs and exact candidate integrity values.
• Regenerate the Website API/package and CLI snapshots from installed 0.5.0 candidate packages. The API snapshot contract now records the installed public surface directly, without 0.4 router-symbol substitutions.
• Use the supported Vite+ test and config entrypoints in tests and the usage guide.

Local qualification

Node 24.21.0 and npm 12.0.1; candidate registry http://127.0.0.1:54709/.

• Frozen 18-package graph inventory SHA-256: 589d5b2be0e096b438ad7a28c8ff845033b9883594085db0a50958ec96b6b3fb
• Website lock SHA-256: 3b70fff9b38367ddd5fd4cf4c7858447dbed8e7cd693f83e777fb4b19d7c64ab
• Clean npm ci: 17 installed AskrJS packages verified at 0.5.0 against their inventory SRIs and canonical URLs.
• npm run docs:snapshot: 5/5 passed.
• npm run check: formatting, lint, typecheck, 40 unit tests, 41 Chromium tests, client/LLM/SSG builds, all 478 SSG routes, and both generated-output tests passed.
• Full and production npm audit: zero vulnerabilities.

The Vite+ 0.3.3 / Vitest mocker optional peer metadata warning is recorded by the local npm resolver; normal install and all application gates pass without peer override flags.

The inventory binds the archives to current producer PR heads. Rebuild and requalify the graph after producer integration into develop. Hosted clean-install jobs may return E404 until 0.5.0 packages publish. This PR does not publish packages or promote to main.

Hosted develop check

The CI workflow now runs for pull requests targeting develop as required by the active branch ruleset. Run 38337855829 reached npm ci and failed with E404 for the unpublished @askrjs/vite@0.5.0; later steps were skipped. Local exact-graph install, npm run check, and full/production audits passed as described above. Do not treat the expected prepublication E404 as a local gate failure; the PR remains blocked by the required hosted status until 0.5.0 is available publicly.