- Bump @classytic/mongokit to ^3.16.1 (devDep + arc init scaffold pin).
  3.16.1 strips `default` from the generated update-body schema, fixing a
  silent PATCH data-loss bug: arc's createApp runs AJV with useDefaults:true,
  so a nullable field carrying default:null (e.g. publishedAt) had null
  injected into any PATCH that omitted it and the repo $set it.
- New load-bearing e2e tests/e2e/update-default-injection.test.ts drives the
  whole pipeline (route schema -> AJV -> BodySanitizer -> $set): passes on
  3.16.1, fails on 3.16.0 (verified by downgrade). Hosts on mongokit >=3.16.1
  need no per-app stripDefaults workaround.
- Scaffold arc self-pin -> ^2.18.5.
- CHANGELOG: 2.18.5 (also backfills the 2.18.4 SSE lazy-auth entry).