fix(server): stop sending immutable cache-control on /__webjs/core/* (#38)

The /__webjs/core/* paths are un-versioned: every bump of
@webjskit/core ships different bytes at the same URL. Sending
`cache-control: public, max-age=31536000, immutable` instructed
edge CDNs (Cloudflare in our case) to pin the prior bytes for up
to a year, which silently broke the next deploy: browsers loaded
the old client renderer against a server emitting the new SSR
shape, and any new exports (e.g. slot.js entry points added for
core 0.6.0) resolved to undefined in the cached file.

ETag + ~1h max-age is the right policy until URLs carry a version
hash. Drop immutable.

Bumps @webjskit/server to 0.7.1.

Regression: 2026-05-20, ui.webjs.dev tier-2 components after
@webjskit/core 0.5.0 -> 0.6.0 republish.

Author: vivek7405

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjskit/server",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "type": "module",
   "description": "webjs dev/prod server: SSR, router, API, server actions, live reload",
   "main": "index.js",

packages/server/package.json

@@ -389,11 +389,23 @@ async function handleCore(req, ctx) {
   }
 
   // Core module: /__webjs/core/*
+  //
+  // ETag + ~1h max-age, NOT immutable. The URL path is un-versioned
+  // (`/__webjs/core/src/render-client.js` etc.), so bumping
+  // `@webjskit/core` ships different bytes at the same URL. An
+  // `immutable` cache-control directive at an edge CDN (Cloudflare,
+  // Vercel, Fly) keeps the prior bytes pinned for up to a year, which
+  // silently bricks the next deploy: browsers load the old client
+  // renderer against a server emitting the new SSR shape, and any
+  // exports added in the bump (e.g., the slot.js entry points landed
+  // for 0.6.0) resolve to undefined in the cached file.
+  // Regression: 2026-05-20, ui.webjs.dev tier-2 components after
+  // @webjskit/core 0.5.0 -> 0.6.0 republish.
   if (path.startsWith('/__webjs/core/')) {
     const rel = path.slice('/__webjs/core/'.length);
     const abs = resolve(coreDir, rel);
     if (!abs.startsWith(coreDir)) return new Response('forbidden', { status: 403 });
-    return fileResponse(abs, { dev, immutable: !dev });
+    return fileResponse(abs, { dev, immutable: false });
   }
 
   // Vendor bundles: /__webjs/vendor/<pkg>.js: generic auto-bundler