Unify asset build preparation and supervised development sessions - #37

Summary

• Incorporate Roman Kurakin's fix(js): read the format key only when it holds formatter options #36 formatter/discovery guards for The format option has two meanings #34, preserving authorship and adapting the regression to the renamed Discovery API with deterministic fixtures.

• Require patched Igniter (>= 0.8.4) and Bandit (>= 1.12.5, still test-only in Volt); raise the Bandit floor in all five Phoenix examples.

• Refresh example Phoenix and LiveView locks to compatible security-patched releases, preserving their existing LiveView minor series.

• Require QuickBEAM 0.11.1 for release-optimized, baseline-CPU native builds and the Mint 1.10 dependency floor; refresh the Phoenix example lockfile.

• Align nine source paths with established module names, normalize Mix-task test namespaces, and compile shared test support only in test builds.

• Clarify discovery and cleanup API names; move hashing and file metadata helpers to their owners without changing behavior.

• Compose module-graph and Tailwind output through typed artifact plans, validate manifests/collisions before emission, and stage publication with manifest-last installation.

• Introduce session-owned ETS tables, compiler runtimes, stylesheet workers, and filesystem watching with restart-safe request handles and scoped HMR.

• Retain Tailwind compiler contexts and track discovered sources/dependencies, including failed-load recovery; serve last successful CSS and order document reloads after successful CSS builds.

• Isolate vendor caches by compilation context, normalize output layout/assets directories, and organize Mix task source/tests into matching nested directories.

• Handle disappearing session processes with retryable responses and document explicit CLI-owned session attachment for Phoenix/Plug hosts.

• Keep cached asset requests independent of watcher rebuilds by verifying immutable configuration through the session state owner.

• Serve resolved outside-root stylesheet assets through session-scoped URL grants rather than filesystem-path requests.

• Normalize disabled Tailwind configuration and expose dependency-ordered manifest stylesheet traversal.

• Assemble scoped Vue component exports for both template-only and script-bearing SFCs without capturing module bindings such as Object.

Compatibility

• Volt.JS.Discovery.files/0,1 and format_files/0 replace Volt.JS.Helpers.discover_files/0,1 and discover_format_files/0; this public rename is recorded in Unreleased breaking changes.
• Source-path alignment preserves established type/module identities. No compatibility wrappers or broad large-module decomposition are added.

Validation

• Clean-build mix ci: 697 passed, 5 skipped, 39 integration tests excluded.
• Hashing regression preserves the exact eight-character lowercase SHA-256 naming contract.
• Test support is absent from non-test and consuming dependency builds; renamed modules leave no stale BEAM files.
• Fresh mix compile --force --warnings-as-errors passes. Corrected a naming-rewrite artifact (state.session() instead of field access) found during fresh consumer compilation.
• Runtime regression verifies scope attachment with a shadowed Object binding and preserves component identity.
• Hosted Elixir 1.18/OTP 27 and Elixir 1.20/OTP 29 checks pass.
• Explicit integration suite: 43 passed, 5 skipped, covering real-filesystem sessions, the Phoenix example, and browser/HMR behavior.
• Browser Vue fixture: CSS changed red to blue while Count: 2 and an in-memory page marker were preserved.

Boundaries / follow-up

• Bandit, Igniter, and the subsequently discovered example Phoenix/LiveView advisories are addressed. The updated dependency resolutions report no security advisories.
• Four additional framework examples compile; their pre-existing Volt.entry_path/1 deprecation remains a separate migration concern.
• Publication is staged, not a whole-directory transaction; cross-process coordination and crash durability are not guaranteed.
• Place the development asset Plug before Plug.Static to avoid stale disk interception. Choose one watcher owner; conflicting configurations are rejected.
• Legacy direct watcher/global-state APIs remain compatibility boundaries.
• Astral integration follows on this branch/API; neither package is being released by this PR.