0.1.2 moved the dependency range to `^0.4.2` but the lockfile was never
regenerated: it still carried `^0.4.1` and resolved kit 0.4.1. Both CI jobs run
`bun install --frozen-lockfile`, which fails outright when the lock disagrees
with package.json — so the build gate and the publish job would both have died
on a `v0.1.2` tag.
The lock now resolves 0.4.3. The registry has no 0.4.2 at all: that tag's
publish never landed, and rather than move a pushed tag the kit was cut as
0.4.3, which this range accepts and which carries the same `findLocalArtFile`
cover-art scan 0.1.2 was written against.
Gates on the refreshed tree: typecheck clean, 10/10 tests, biome clean, bundle
builds both entry points.
enricobuehler