spec-change: versions[] last entry cannot carry its own CID (self-referential); make cid optional for the current version

[cursor]

Observation (first live Sepolia publish, 2026-09-15)

SPEC §3 says versions[] "MUST include the current version as its last entry" and each entry has a required cid. The current entry's cid is self-referential: the manifest cannot contain its own CID, because adding the CID changes the bytes and therefore the CID.

Today enspack publish writes the CID of the draft (pre-versions[]) bytes there, so versions[last].cid (bafkreiduwt…) never equals the contenthash CID (bafkreia47x…) for v1-0-0.qwen--qwen3-0-6b.mirrors.enspack.eth. Anything that displays versions[latest].cid as "the manifest CID" (catalog site trust chain) shows a CID that resolves to nothing. enspack get/install are unaffected (they use the on-chain CID).

Proposed diff (SPEC.md §3, enspack/0.2)

- "versions": [                                                   // full history including this version
-   { "version": "1.0.0", "name": "v1-0-0....", "cid": "bafy...", "createdAt": "..." }
- ]
+ "versions": [                                                   // full history; the last entry is this version
+   { "version": "1.0.0", "name": "v1-0-0....", "createdAt": "..." }   // no cid: a manifest cannot contain its own CID
+ ]
+ Rules: every entry except the last MUST carry `cid` (the CID that version's name resolved to when
+ this manifest was assembled); the last entry MUST NOT carry `cid`. Clients take the current
+ version's CID from `contenthash`.

schema/enspack.schema.json: make versions[].cid optional (validator enforces "present on all but the last, absent on the last").

Until then (0.1, behind no flag)

Publishers write a schema-valid placeholder in the last entry (the CLI/bootstrap already effectively do); consumers and the indexer/catalog MUST use contenthash / the indexer's latest.cid for the current version and only read versions[i].cid for i < last.