v0.4.0

cas registry — auto-detect primary registries

Sweeping cas across a multi-repo org (some on CodeArtifact, some on public npm, some mid-migration) needed a way to gate every project against its own primary registry instead of forcing a single allowlist.

Without --allowed-host: cas registry now reads the lockfile's resolved URL distribution and treats every host carrying ≥20% of the top host's entry count as primary. A 100% CA lockfile, a 100% npm lockfile, and a legitimate CA + corporate-mirror mix all pass cleanly. One-off anomalies (the dependency-confusion attack signature) still fall below the threshold and are flagged as CRITICAL.

With --allowed-host: unchanged. Strict, label-anchored suffix match.

RegistryReport gains detected_primary_hosts: list[str], surfaced in both human and JSON output.

Fixes

• cas drift / registry / scripts now catch ValueError from load_lockfile and emit a clean [HIGH] FAIL — unsupported lockfileVersion 1 instead of a Python traceback. Surfaced while sweeping ~18 v1-format archive repos.