v0.1.18

Keep the dev-dependency alignment, drop the workspace: protocol

The internal ranges had been rewritten to workspace:^. That resolves inside
this monorepo and nowhere else: every package CI checks out its own repository
alone and runs pnpm install, where the protocol has no workspace to point at
and fails with ERR_PNPM_WORKSPACE_PKG_NOT_FOUND before a single test runs. The
concrete ranges are back; the dev-dependency bumps that came with the same edit
are kept, and now match what the lockfile already resolved.

docs: the subscription route mounts in start(), not boot()

fix(provider): mount the subscription route in start(), not boot()

Upstream documents start for routes, and the order is what makes it matter:
providers boot, then providers START, then the preloads run — and the preloads
are where an application writes its own routes. Mounted in boot, this landed
ahead of every application route, so an overlapping path was answered here
rather than by the app that meant to override it.

Publishing the singleton stays in boot: it is bookkeeping, and something else
may resolve it while booting.

---

Changes since v0.1.17.