v4.0.1

fix(monorepo-cleanup): v4.0.1 — strip redundant devDependencies from published package.json

Pre-v4.0.1 each package's package.json carried a devDependencies
block that:

• duplicated the peerDependencies entries verbatim (the @kadena/*
  set on both packages, plus @noble/curves + @scure/bip39 on stoa-
  core), and
• in ouronet-core's case, also listed @stoachain/stoa-core: "*" —
  workspace-resolution plumbing that resolved to the local symlink at
  dev time but shipped to npmjs.com as the meaningless wildcard "*"
  (the canonical 4.0.x peer-dep already pins the exact version).

Both blocks shipped to npmjs.com, where they appeared under "Dev
Dependencies" on each package page next to the canonical "Peer
Dependencies" section. Functionally harmless (npm ignores
devDependencies at consumer install time) but cosmetically confusing —
consumers reading the package page saw the same entries listed twice.

v4.0.1 drops the devDependencies blocks entirely. The npmjs.com
pages now show the cleaner shape:

@stoachain/stoa-core@4.0.1
dependencies: @stoachain/dalos-crypto@4.0.3
peerDependencies: @kadena/client@1.18.3,
@kadena/cryptography-utils@0.4.4,
@kadena/hd-wallet@0.6.2,
@kadena/types@0.7.0,
@noble/curves@1.9.7,
@scure/bip39@1.6.0
devDependencies: (none)

@stoachain/ouronet-core@4.0.1
dependencies: (none — all runtime imports go through peer-deps)
peerDependencies: @stoachain/stoa-core@4.0.1,
@kadena/client@1.18.3,
@kadena/cryptography-utils@0.4.4,
@kadena/types@0.7.0
devDependencies: (none)

Atomic-version invariant

Both packages bump from 4.0.0 to 4.0.1 even though the change applies
identically. This preserves the "both packages always release at the
same version" rule baked into the smart-publish workflow's queue
detection. The peer-dep on @stoachain/stoa-core in
ouronet-core/package.json bumped from "4.0.0" to "4.0.1" accordingly.

Local development

The npm 7+ workspace resolver auto-installs peer-dependencies into the
root node_modules/ at npm install time, so the per-package
devDependencies duplicates were not needed for tests to run. Build +
test + typecheck all confirmed green after the strip.

Regression-lock test updates

Both packages' tests/package-version.test.ts updated to assert
pkg.version === "4.0.1" so the npm test gate fails immediately if
a future edit accidentally drifts the published-version string out of
sync with the docs.

Verification

• npm run typecheck — 0 errors across both packages
• npm test — 703/703 passing (485 stoa-core + 218 ouronet-core)
• npm run build — both dist/ trees emit cleanly
• Publish-workflow doc gates simulated locally: ✓ Status block,
  ✓ version-history entry, ✓ CHANGELOG first-heading on BOTH
  packages at TAG_VERSION=4.0.1

NO source-code change. NO behaviour change. NO breaking change for
consumers — the entries removed were never used at consumer install
time. Ready for /bee:pollinate.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com