Missed in the rename commit; the fuzz target referenced the old name and
broke the build under the [afl] profile.

The merlint redundant-prefix check flagged [Cookie.cookie_header] and the
internal [Cookie.cookie_attributes] type. Rename to:

- type [cookie_attributes] -> [attributes] (file-local).
- val [cookie_header] -> [request_header] (build the HTTP "Cookie:"
request header).
- val [of_cookie_header] -> [of_request_header] (parse the same).

[set_cookie_header] / [of_set_cookie_header] keep their names — the
"Set-Cookie" prefix is the canonical HTTP header name and merlint
already accepts it.

ocaml-requests is the only downstream caller and is updated in step.

93 cookie tests pass; merlint clean on ocaml-cookie.

Sweep through 23 more packages flagged by [monopam lint] for
test-stanza references not declared in opam. Each verified by
[dune build] + [dune runtest] before moving on.

- irmin add (astring :with-test)
- ocaml-atproto-oauth add (eio_main :with-test) (nox-crypto-rng :with-test)
- ocaml-auth add (alcotest :with-test) (eio :with-test) (eio_main :with-test)
- ocaml-cam add (odm :with-test)
- ocaml-cbor add (alcotest :with-test) (ohex :with-test)
- ocaml-cfdp add (nox-csv :with-test)
- ocaml-claude add (vlog :with-test)
- ocaml-collision add (alcotest :with-test) (odm :with-test) (ptime :with-test)
- ocaml-cookie add (re :with-test)
- ocaml-cop1 add (nox-csv :with-test)
- ocaml-crc add (nox-csv :with-test) (nox-memtrace :with-test)
- ocaml-dns-eio add (mdx :with-test); also fix a misplaced
paren in the depends list.
- ocaml-gauth add (nox-crypto-rng :with-test)
- ocaml-http add (alcotest :with-test) (eio_main :with-test) (nox-csv :with-test)
- ocaml-ltp add (nox-csv :with-test)
- ocaml-matter add (ohex :with-test) (ptime :with-test)
- ocaml-oauth add (eio_main :with-test) (nox-crypto-ec :with-test)
- ocaml-ocm add (alcotest :with-test) (nox-csv :with-test)
- ocaml-oem add (alcotest :with-test) (nox-csv :with-test)
- ocaml-opm add (alcotest :with-test) (nox-csv :with-test)
- ocaml-pbkdf2 add (ohex :with-test)
- ocaml-requests add (astring :with-test) (nox-csv :with-test)
- ocaml-retry add (re :with-test)

Sweep of every consumer that previously depended on either the
standalone [nox-xdge] package (the Eio wrapper) or dune's internal
[xdg] library. Both are gone after the previous commit; consumers
now point at the merged [nox-xdg] package's two libraries:

- Code that used the Eio wrapper ([Xdge.v fs app_name],
[Xdge.config_dir], etc.) -> [Xdg_eio.foo], library [nox-xdg.eio].
- Code that used the pure spec ([Xdg.create ~env ()],
[Xdg.cache_dir]) -> unchanged module name [Xdg], library
[nox-xdg].

Touched packages:

- gauth, gdocs, gsheets, gslides -- the Google credential stack;
[Gauth.Local_store] uses [Xdg_eio] internally.
- ocaml-requests, ocaml-cookie -- HTTP client and cookie jar;
[Requests.t] takes an [?xdg:Xdg_eio.t] for cookie persistence.
- ocaml-agent, ocaml-atp, ocaml-slack, ocaml-linkedin, monopam,
uniboot -- CLIs that compute their own config / cache / state
paths via the Eio wrapper.
- ocaml-oci -- uses the pure spec ([Xdg.cache_dir]) for OCI image
layout; migrated from dune-internal [xdg] to [nox-xdg].

Mechanical changes per package:

- [dune-project]: opam dep [nox-xdge] -> [nox-xdg].
- [lib/dune] and [bin/dune]: library reference [nox-xdge] ->
[nox-xdg.eio] (or [nox-xdg] for the rare pure-spec consumer).
- [.ml] / [.mli]: [Xdge] -> [Xdg_eio].

Generated [.opam] files updated by the dune build accordingly.

The previous validation block asserted via [Result.is_error]; rewrite
as an mdx toplevel session (printed types and values) so the example
reads like an OCaml top-level you can paste into utop.

Restore the [@see <RFC 6265>] tags removed in the prior commit by
moving them to the end of each module-level docstring, after the
[{2 ...}] section headings (odoc rejects headings inside [@see]).

Three problems collapsed into one fix:

- README ocaml blocks referenced unbound names ([cookies], [clock],
[jar], [path]) so mdx couldn't compile them. Wrap each snippet as a
function that takes its inputs explicitly.
- Validation block used trailing comments to claim [Ok ...] / [Error
...] results without checking. Replace with [assert] so mdx verifies
the behaviour.
- [cookie.mli] and [cookie_jar.mli] had a stray [@see <RFC 6265>] tag
followed by a [{2 ...}] section heading; odoc rejects headings inside
[@see]. Drop the redundant tag (RFC 6265 is linked elsewhere in the
same docstring).

Add [fmt] to the mdx libraries for [Fmt.pr].

Remove libraries declared in '(libraries ...)' clauses but unreferenced
by any module in the same source tree, as flagged by 'monopam lint'
after the new Dead_lib detection landed. Touches 131 dune files across
~80 packages.

A few stanzas needed a positive correction instead of a pure removal:

- ocaml-git/bin/diag: depended on eio_main + bytesrw-eio for an
Eio_posix.run call site; the umbrella was overkill, switch to the
precise eio_posix package.
- ocaml-scaleway/lib, ocaml-s3/lib: scaleway.mli / s3.mli reference
Eio_unix.Stdenv.base; eio.unix is required and was missing.
- merlint/lib: pulled bytesrw + nox-opam.bytesrw to surface
Opam_bytesrw, used by rule e915 and lint helpers.

Stanzas where Dead_lib was a false positive (transitive dep needed
for module visibility, virtual-library impls) are left untouched —
e.g. helix.jx.jsoo for ocaml-globe/demo retains its (libraries ...)
entry because it provides the impl of the helix.jx virtual lib.

Add (mdx ...) stanza to lib/core/dune. The two odoc examples now use
Ptime.epoch as the deterministic clock and assert on the parsed cookie
fields (name, value, secure, http_only) so the build catches future
regressions in of_set_cookie_header / of_cookie_header.

In lib/jar/cookie_jar.mli, the Mozilla-format snippet was wrapped in
{[ ... ]} but is shell-tab pseudocode (not OCaml). Switched to {v ... v}
verbatim so it can be added to the mdx stanza later without false
parse errors.

Several packages had alcobar/alcotest/mdx/bytesrw/etc. used in
test/ or fuzz/ but undeclared in dune-project, leaving the opam
metadata silently incomplete. Sync the dune-project depends and
regenerate the opam files.

The READMEs all share the standard install/overlay snippet, but the
sh blocks lacked the "<!-- $MDX skip -->" directive. `dune test`
would shell out to `opam install` against the live switch, which
either prompts interactively or fails with a package conflict —
either way diffing as a test failure.

Bulk-add skip directives in front of every install/overlay block.
Also collapse the doubled "non-deterministic + skip" stack on three
READMEs (memtrace, ocaml-dpop, ocaml-pid1, ocaml-yaml, merlint) where
`skip` already implies the runtime is bypassed.

Each README's 'opam install <pkg>' instructions now match the post-rename
opam package names. Auto-generated by 'monopam lint --fix' after the
nox-* prefix landed on the underlying packages.

Renames 35 packages to make blacksun forks distinguishable from their
opam-repository upstreams. Module names (Git.x, Tls.x, ...) stay bare;
opam package names and dune (public_name) findlib references move to
nox-X. After this commit, zero local package names overlap with
opam-repository.

Renamed:
- nox-git, nox-irmin
- nox-crypto, nox-crypto-pk, nox-crypto-rng, nox-crypto-ec
- nox-tls, nox-tls-eio, nox-tar, nox-tar-eio, nox-tty, nox-tty-eio
- nox-arp, nox-ca-certs, nox-cbor, nox-cookie, nox-crc, nox-csv
- nox-gpt, nox-hkdf, nox-http, nox-jwt, nox-kdf, nox-loc
- nox-memtrace, nox-pds, nox-sexp, nox-slack, nox-toml
- nox-websocket, nox-x509, nox-xdge, nox-yaml

Also drops orphan tar-mirage and tar-unix opam templates that had no
matching package stanza.

Each fork's dune-project (source ...) now matches the canonical
upstream URL recorded in sources.toml, so the generated dev-repo:
in opam-repository points users at the real home rather than the
in-monorepo collaboration fork. Where Thomas is doing maintenance
on the fork but isn't yet listed, add him to the relevant author
or maintainer fields.

ca-certs -> github mirage/ca-certs
(added Thomas to authors and maintainers)
ocaml-cbor -> tangled anil.recoil.org/ocaml-cbort
ocaml-cookie -> tangled anil.recoil.org/ocaml-cookeio
ocaml-json -> github dbuenzli/jsont
ocaml-jwt -> tangled anil.recoil.org/ocaml-jsonwt
ocaml-tar -> github mirage/ocaml-tar
(added Thomas to maintainers)
ocaml-toml -> tangled anil.recoil.org/ocaml-tomlt
ocaml-yaml -> tangled anil.recoil.org/ocaml-yamlt

Pure formatting changes from `dune fmt`: doc comment placement moves
from above the binding to below it for `type`s, multi-line `match`
expressions collapse onto one line where they fit, and infix operator
applications pick up spaces (`Soup.($?)` -> `Soup.( $? )`). No
semantic changes.