The packages are used across more than a hundred projects. Referencing a git
URL would mean editing a hundred manifests and churning a hundred lockfiles,
where staying on npm means a semver range that already resolves and one
environment variable per machine. That decides it: `npm install backloop.dev`
stays, and the plugin depends on `^4.0.0` from the registry rather than on a git
URL.

Deprecation stops below 4.0.0. Everything from the public-service era carries
the message — that is what a stranger running `npm install backloop.dev` lands
on, since they get 3.1.0. Deprecating 4.0.0 as well would put a warning on every
install in every project that legitimately uses it, forever, to tell those
people something they already know.

The split into separate repositories still happens, for its own reasons; it is
no longer what makes installation work. `private: true` is therefore gone from
both manifests, since publishing is exactly what we intend to do.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>