chore(deps): move the auth baseline to the released upstream, drop the 0.3.x compat shim

[y1o1]

Every workspace package now requires @o3co/auth.policy-verifier.{core,builtins,server} ^0.8.1 and @o3co/auth-provider-{core,oauth} ^0.12.0 — the versions published on 2026-09-06 — and the generators emit the same as exact pins (DEFAULT_DEP_VERSIONS: 0.8.1 / 0.12.0). Both generators move to 0.2.0 per create-app.md § 3.3. The lockfile no longer resolves 0.3.1 or 0.5.3 anywhere.

What the pin makes removable

With the released API as the floor, the dual paths that kept 0.3.x loadable are gone:

• policy-verifier-dplaax-module/collectors/context.mts (subjectClaims / untrustedRequestFields, reaching readUntrustedRequestContext by reflection) is deleted. Collectors read context.subject and call readUntrustedRequestContext directly. Its 3-case test goes with it; the six collector/rule tests build CollectorContext in the current shape (subject, marked requestContext, required signal). 50 cases remain = the 53 on develop minus exactly the 3 in the deleted file (verified case by case).
• The policy-verifier template and the integration test import builtinKeyResolversModule instead of probing the server namespace; the template reads config.logging.level directly. The integration test's it.skipIf(!Reflect.has(server, "JWT_MODE_MIGRATION_MESSAGE")) guard is dropped (the export exists at 0.8.1), so its two rows now run: 15 passed, up from 13.

The code had already crossed the intervening upstream BREAKING changes — o3co/auth's provin-compatibility job builds this workspace against those exact revisions — so this PR changes what is declared and removes the branch of each dual path that could otherwise drift.

@o3co/ts.hocon stays at 0.1.5: its 0.1 → 1.x move is a separate migration.

Verification

• Workspace: 550 tests across 7 workspaces (did-dplaax 31, provider-did 216, create-policy-verifier 110, provider-dplaax-module 31, policy-verifier-dplaax-module 50, create-provider 97, integration 15 + 1 xfail + 1 skipped); typecheck, lint, build clean.
• Generated instances, paired with this branch's modules (--dplaax-module-ref e0b41da): a single @o3co/* version installed in each (no 0.3.x / 0.5.x alongside), typecheck exit 0 for both, tests 18 / 26.
  • Pairing matters: generating against the previous develop ref installs the old module's 0.5.3 / 0.3.1 next to the app's 0.12.0 / 0.8.1 and fails typecheck on Module identity (Module[] → readonly Module[] can only fail across two Module declarations). That is the failure smoke-workspace would show if the modules and the defaults ever disagree again.

After merge

o3co/auth bumps PROVIN_REV to the merge commit; provin-compatibility re-runs against the candidate auth tarballs. #21 (develop → main) picks this up as a branch PR.

🤖 Generated with Claude Code