Slingshot v0.3.3 — WebSocket query-param auth fix

WebSocket upgrades rejected valid session tokens: hasPresentedCredential() counted a ?token= query param as a credential, but actor resolvers read headers/cookies — and browsers cannot set headers on a WS connect, which is the whole reason query-param auth exists. Anonymous sockets connected; AUTHENTICATED ones were refused, leaving logged-in clients in a permanent reconnect loop. Reproducible with curl against a token the same server had just minted: REST 200, socket 401.

withQueryTokenAsHeader() re-presents the query token as the standard user-token header, scoped to the WS upgrade path only — widening the shared REST resolver would leak credentials into access logs, referrers and history on every request. Header/cookie credentials still win over the URL param.

Verified: valid token 401 -> 101; anonymous still 101; bogus token still 401. Downstream, 27 previously-failing e2e specs in a consuming app now pass (199/199).

This fix was already on main but reached NO consumer — v0.3.2 released one commit below it, and versions were never bumped, so publish skipped everything as already-published. Root slingshot and slingshot-game-engine are bumped to 0.2.3.

Also: replay durability in game-engine — configurable ReplayStore, microtask-coalesced ordered flush (entries previously buffered the whole session and flushed once from endGameFlow, so a crash lost everything), and replay.retainOnCleanup.

typecheck clean · 14,898 tests pass · 0 fail

Consumers must upgrade to get the socket fix.