v0.1.0-pre.16 — sealing dimension foundation + at-* family debut

Opt-in early-adopter channel: pnpm add @noy-db/hub@next

Sealing dimension foundation + at-* family debut

• New SealingKeyProvider contract + sealed envelope (#14/#186) — seal the vault with a key drawn from the environment, for unattended / managed-host unlock.
• at-* provider family debuts: @noy-db/at-env (#187) and @noy-db/at-macos-keychain (#191).
• Managed-passphrase mode mandates a strong recovery profile + recoverManagedPassphrase (#195).

Recovery, bundles, derivations

• db.rotateRecovery() (#121), Shamir recovery-profile dispatch (#196 s1).
• Sealed bundle delivery — autoPassphrases/sealedPassphrases (#197 s1); variable-N derivations shape: 'array' (#200 s1).

Schema introspection

• Persisted JSON Schema (#174), vault.dumpSchema() (#175), noydb describe CLI (#176).

Fixes

• Collection._doDelete eager MV refresh (#183); import:<format> ledger tagging (#184); as-xlsx column widths (#182).
• Build: removed on-shamir's dead hub deps that had reddened main since #196 (cycle); proper decoupling deferred to #211.

Public-API lock: autoPassphrases, sealedPassphrases, recoverManagedPassphrase, rotateRecovery, managedPassphrase are now public — future slices extend, not rename.