v0.4.1 — Directory fetch contract

Out-of-band directory discovery now requires HTTP 200, rejects redirects, validates the directory media type, and validates the supplied origin shape.