0.4.0-preview.1

@assetlib/sdk-core and @assetlib/sdk-expo 0.4.0-preview.1, @assetlib/cli 0.1.0

Distributed as exact-version tarballs; install the core and Expo tarballs from this release together. The audit package is unchanged at 0.1.0 and remains on npm.

• Staging environment in the public configuration, and a pinned key set (pinnedPublicKeys, keyIds) alongside the single key.
• Signed variantSchemaVersion: 1 validation and resolution of appearance and arm cells in the fixed order, with cache keys per selected cell; Expo components follow the system color scheme and accept an arm prop.
• A decide callback supplies the arm from the app's experiment tool, evaluated outside the operation queue with a bounded wait and re-resolution against current state.
• Opt-in telemetry: coalesced resolve, display, and fallback events with a random per-install id, flushed on an interval, on refresh, on demand, and on app background. Off by default.
• Storage namespace derived from origin, org, app, and environment only, with a one-time verified migration from the previous formulas, so the replay floor and cache survive key-set changes and the legacy to environment URL switch.
• New @assetlib/cli: assetlib sync registers a build and its catalog with the console (HTTPS only; loopback HTTP behind an explicit flag), assetlib hash, assetlib check, and assetlib adopt, a dry-run codemod that turns bundled Expo image call sites into declared placements.

Verification: core 251, Expo 78, audit 9, CLI 65 tests; typecheck and build. SHA256SUMS covers every tarball.