tsc doesn't remove stale output, so a file deleted or renamed in src
kept shipping from dist via the files allowlist. That is exactly how an
orphaned device.js — dead code nothing imported — ended up inside the
published 0.4.0 tarball, which was otherwise built from the v0.4 tree.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>