Sweep through 23 more packages flagged by [monopam lint] for
test-stanza references not declared in opam. Each verified by
[dune build] + [dune runtest] before moving on.

- irmin add (astring :with-test)
- ocaml-atproto-oauth add (eio_main :with-test) (nox-crypto-rng :with-test)
- ocaml-auth add (alcotest :with-test) (eio :with-test) (eio_main :with-test)
- ocaml-cam add (odm :with-test)
- ocaml-cbor add (alcotest :with-test) (ohex :with-test)
- ocaml-cfdp add (nox-csv :with-test)
- ocaml-claude add (vlog :with-test)
- ocaml-collision add (alcotest :with-test) (odm :with-test) (ptime :with-test)
- ocaml-cookie add (re :with-test)
- ocaml-cop1 add (nox-csv :with-test)
- ocaml-crc add (nox-csv :with-test) (nox-memtrace :with-test)
- ocaml-dns-eio add (mdx :with-test); also fix a misplaced
paren in the depends list.
- ocaml-gauth add (nox-crypto-rng :with-test)
- ocaml-http add (alcotest :with-test) (eio_main :with-test) (nox-csv :with-test)
- ocaml-ltp add (nox-csv :with-test)
- ocaml-matter add (ohex :with-test) (ptime :with-test)
- ocaml-oauth add (eio_main :with-test) (nox-crypto-ec :with-test)
- ocaml-ocm add (alcotest :with-test) (nox-csv :with-test)
- ocaml-oem add (alcotest :with-test) (nox-csv :with-test)
- ocaml-opm add (alcotest :with-test) (nox-csv :with-test)
- ocaml-pbkdf2 add (ohex :with-test)
- ocaml-requests add (astring :with-test) (nox-csv :with-test)
- ocaml-retry add (re :with-test)

Per-package removal of opam runtime [depends] entries that
[monopam lint] flagged as unused -- packages declared as runtime deps
but referenced by no library [(libraries ...)] stanza in any of the
package's main lib/exec dune files (and not pulled in transitively
via META).

Verified each removal by running [dune build] (and [dune test] for
packages with a test suite) before moving on. No code changes -- only
dune-project [(depends ...)] lists.

Packages touched:

- ca-certs drop nox-crypto
- dupfind drop bos
- merlint drop nox-json (still pulled in via nox-opam.bytesrw)
- monopam drop bytesrw, requests
- monopam-info drop nox-loc, nox-sexp
- ocaml-agent drop nox-tty
- ocaml-atproto-oauth drop did-plc, did-web
- ocaml-auth drop nox-json
- ocaml-cam drop ptime
- ocaml-claude drop nox-loc
- ocaml-cop1 drop logs
- ocaml-did drop bytesrw
- ocaml-ewah drop bytesrw
- ocaml-freebox drop ipaddr
- ocaml-gauth drop base64, ptime
- ocaml-gdocs drop oauth
- ocaml-gsheets drop oauth
- ocaml-gslides drop oauth
- ocaml-hap drop nox-crypto-rng
- ocaml-jailhouse drop fmt

Generated [.opam] files updated by dune accordingly.

Remaining unused warnings ([ocaml-jwt], [ocaml-meross], [ocaml-oci],
[ocaml-pid1], [ocaml-publicsuffix], [ocaml-punycode], [ocaml-pus],
[ocaml-qemu], [ocaml-rego], [ocaml-requests], [ocaml-sbom],
[ocaml-scc], [ocaml-sdls], [ocaml-sigstore], [ocaml-sle],
[ocaml-spacedata], [ocaml-stix], [ocaml-vz], [prune], plus the
[ocaml-ccsds] meta-package and a handful of others) will follow in a
later pass once each is verified against its tests; this commit
covers only the ones I built and tested in this session.

Sweep of every consumer that previously depended on either the
standalone [nox-xdge] package (the Eio wrapper) or dune's internal
[xdg] library. Both are gone after the previous commit; consumers
now point at the merged [nox-xdg] package's two libraries:

- Code that used the Eio wrapper ([Xdge.v fs app_name],
[Xdge.config_dir], etc.) -> [Xdg_eio.foo], library [nox-xdg.eio].
- Code that used the pure spec ([Xdg.create ~env ()],
[Xdg.cache_dir]) -> unchanged module name [Xdg], library
[nox-xdg].

Touched packages:

- gauth, gdocs, gsheets, gslides -- the Google credential stack;
[Gauth.Local_store] uses [Xdg_eio] internally.
- ocaml-requests, ocaml-cookie -- HTTP client and cookie jar;
[Requests.t] takes an [?xdg:Xdg_eio.t] for cookie persistence.
- ocaml-agent, ocaml-atp, ocaml-slack, ocaml-linkedin, monopam,
uniboot -- CLIs that compute their own config / cache / state
paths via the Eio wrapper.
- ocaml-oci -- uses the pure spec ([Xdg.cache_dir]) for OCI image
layout; migrated from dune-internal [xdg] to [nox-xdg].

Mechanical changes per package:

- [dune-project]: opam dep [nox-xdge] -> [nox-xdg].
- [lib/dune] and [bin/dune]: library reference [nox-xdge] ->
[nox-xdg.eio] (or [nox-xdg] for the rare pure-spec consumer).
- [.ml] / [.mli]: [Xdge] -> [Xdg_eio].

Generated [.opam] files updated by the dune build accordingly.

Lift the per-tool [Store] modules into one [Gauth.Local_store]. All
three Google CLI tools ([gdocs], [gsheets], [gslides]) now point at a
single XDG config directory ([$XDG_CONFIG_HOME/google/{client,token}.json])
so a user runs [install] and [login] once and every tool that
recognizes the granted scopes can read the resulting token.

Before, each package had a near-identical 60-line [Store] (atomic
write, save/load client and token, [acquire] returning a refreshable
[Gauth.token]) keyed off its own per-tool app name -- three copies
with cosmetic differences (the [cli_name] in the
"Run [<tool> install] first" diagnostic). Each per-tool [Store] is
now a thin wrapper:

include Gauth.Local_store
let acquire http ~clock ~fs =
Gauth.Local_store.acquire http ~clock ~fs ~cli_name:"<tool>"

The shared [Local_store] keeps the atomic-write pattern from the
prior [ocaml-gdocs] / [ocaml-gsheets] / [ocaml-gslides] commits
(sibling [.tmp.<pid>] file with [`Exclusive 0o600], then [rename]
over the target -- no chmod-after-write race, crash-before-rename
leaves the original target untouched).

Side-effect: on first run after this lands, users must re-run
[install] and [login] -- their existing
[~/.config/{gdocs,gsheets,gslides}/] directories are no longer
consulted. Pre-1.0 packages, no migration script.

Move:

- [Gauth.Local_store] in [gauth/lib/gauth.{ml,mli}]: client record,
config_dir/client_path/token_path, save_client/load_client,
save_token/load_token, clear_token, persist, acquire (with
[~cli_name:string] for the diagnostic).
- [gauth] now depends on [nox-xdge] for XDG paths (and [unix] which
was already pulled in transitively).
- [Gdocs.Store], [Gsheets.Store], [Gslides.Store] reduce to ~3 lines
each ([include Gauth.Local_store] + specialized [acquire]).
- Per-tool [lib/dune] and [dune-project] drop their direct
[nox-xdge] / [unix] deps -- those come transitively through gauth.
- Two store tests updated: the "config dir contains '<tool>'"
assertions become "config dir is shared 'google'" since the path
is now [.../google/...] for every tool.

All 307 tests across the four packages pass: gauth (5), gdocs (61),
gsheets (156), gslides (85). [monopam lint] reports the same
pre-existing [oauth unused] / [base64 ptime unused] false positives,
nothing new.

Followups still in flight: the [nox-xdge] -> [nox-xdg] rename is
tracked separately so it can sweep every consumer in one commit
without conflating with this refactor.

Remove libraries declared in '(libraries ...)' clauses but unreferenced
by any module in the same source tree, as flagged by 'monopam lint'
after the new Dead_lib detection landed. Touches 131 dune files across
~80 packages.

A few stanzas needed a positive correction instead of a pure removal:

- ocaml-git/bin/diag: depended on eio_main + bytesrw-eio for an
Eio_posix.run call site; the umbrella was overkill, switch to the
precise eio_posix package.
- ocaml-scaleway/lib, ocaml-s3/lib: scaleway.mli / s3.mli reference
Eio_unix.Stdenv.base; eio.unix is required and was missing.
- merlint/lib: pulled bytesrw + nox-opam.bytesrw to surface
Opam_bytesrw, used by rule e915 and lint helpers.

Stanzas where Dead_lib was a false positive (transitive dep needed
for module visibility, virtual-library impls) are left untouched —
e.g. helix.jx.jsoo for ocaml-globe/demo retains its (libraries ...)
entry because it provides the impl of the helix.jx virtual lib.

Extends the nox- prefix to the remaining encoding/codec packages —
none clash with opam-repository today, but the rule "blacksun forks
get nox-" applies the same way regardless of conflict status.

Renamed: json, xml, meta, opam, protobuf -> nox-*

Renaming packages to nox-* pushed several (libraries ...) lines past
dune fmt's wrap threshold, so dune fmt now spreads them one-per-line.
No semantic changes.

Renames 35 packages to make blacksun forks distinguishable from their
opam-repository upstreams. Module names (Git.x, Tls.x, ...) stay bare;
opam package names and dune (public_name) findlib references move to
nox-X. After this commit, zero local package names overlap with
opam-repository.

Renamed:
- nox-git, nox-irmin
- nox-crypto, nox-crypto-pk, nox-crypto-rng, nox-crypto-ec
- nox-tls, nox-tls-eio, nox-tar, nox-tar-eio, nox-tty, nox-tty-eio
- nox-arp, nox-ca-certs, nox-cbor, nox-cookie, nox-crc, nox-csv
- nox-gpt, nox-hkdf, nox-http, nox-jwt, nox-kdf, nox-loc
- nox-memtrace, nox-pds, nox-sexp, nox-slack, nox-toml
- nox-websocket, nox-x509, nox-xdge, nox-yaml

Also drops orphan tar-mirage and tar-unix opam templates that had no
matching package stanza.

Pure formatting changes from `dune fmt`: doc comment placement moves
from above the binding to below it for `type`s, multi-line `match`
expressions collapse onto one line where they fit, and infix operator
applications pick up spaces (`Soup.($?)` -> `Soup.( $? )`). No
semantic changes.

[monopam lint] flagged [loc] as declared-but-not-needed across:
bottler, dupfind, ocaml-agent / auth / freebox / gauth / hap / http /
linkedin / merlin / meross / oauth / osv / paseto / requests / runc /
scaleway / sigstore / spacedata / stix, plus prune and space.

These packages don't import [Loc] directly — they only pull in
[Json.Error] or similar high-level facades, which re-export the
[Loc] surface they need. Drop the stale declaration so the opam
depends stay honest.

Object combinators: [Object.mem] -> [Object.member], [Object.opt_mem]
-> [Object.opt_member], [Object.case_mem] -> [Object.case_member]. The
sibling submodules [Object.Mem] / [Object.Mems] become
[Object.Member] / [Object.Members]. RFC 8259 §4 calls these
"name/value pairs, referred to as the members", so mirror the spec
name rather than the shortened [mem].

[Object.finish] -> [Object.seal]. "Seal" reads as "close the map, no
more members added", which is what the operation does.

Value constructors/queries: [Value.mem] (function) -> [Value.member];
[Value.mem_find] -> [Value.member_key]; [Value.mem_names] ->
[Value.member_names]; [Value.mem_keys] -> [Value.member_keys].
[type mem = ...] -> [type member = ...]; [type object'] still points
at [member list].

Downstream (~80 files across slack, sbom, stripe, sigstore, requests,
claude, irmin, freebox) updated via perl-pie. dune build clean,
dune test ocaml-json clean.

10-19 usages each: linkedin/{profile,post}, space-dtn/daemon/config,
gdocs/comments, freebox/{switch,calls,firewall,parental,auth},
slack/team, requests/oauth, oci/spec/{manifest,intoto},
meross/timers, atp/atp/lex, gauth.

Same pattern: per-let `let open Json.Codec in` inside codec bodies,
`Json.Codec.list` qualified at the API call sites that wrap codecs
into HTTP requests. No record-field clashes worth annotating in this
batch.

Fixes for:
- Xml.Value.element -> Xml.Value.t (xtce).
- Xml.Error.t to_string wrap (xtce.of_string).
- Json.to_string now plain; drop result patterns across sbom, runc, cdm,
freebox, gauth, gdocs, hap, sigstore, space, meross, stix.
- Loc.Error.t is a record now; read e.meta directly (rego, sbom).
- 'Err' submodule renamed to 'Error' in claude; update refs + test.ml suite list.
- Yaml_jsont -> Yaml_json (space-dtn, space).
- Move sw from Monitor.S.create to Monitor.S.start.
- Drop unused sw, bundle fields from Runc.Command records.
- Drop orphan Compact.rebuild in scitt.Vds; drop 'mutable' from levels (field
content is mutated via array write, not field reassignment).
- Claude Code test: Alcotest.fail e where e is Json.Error.t -> wrap with
Json.Error.to_string.
- toml.jsont dune refs had broken '... loc))' merger in many test/bin dunes.

Toml.ml/Codec.ml and ocaml-http/lib/Xtce.ml xtce have pending mli
mismatches from concurrent linter reshape.

Follow up to the module rename: update the remaining callers that
still referenced [Err] (library [claude.ml{,i}], [client.ml], the test
driver [test.ml]), and fix one stray [^ e] string concatenation in
hermest's CLI that needed [Json.Error.to_string e] now that
[Json.of_string] yields a structured error.

Warning 69 (unused-field, mutable-never-assigned). Four independent
record fields were flagged as mutable but the code only mutates their
referents in place, never rebinds the record slot itself:

- ocaml-wal/lib/wal.ml: [t.file] (the Eio file resource; methods call
Eio.File.pwrite_all etc., the slot is set once at open time).
- ocaml-block/lib/block.ml: [Memory.state.data] (the backing bytes,
written via Bytes.blit_string; [Bytes.t] is already mutable).
- ocaml-sse/lib/sse.ml: [Parser.t.data_buf] (a Buffer.t, written via
Buffer.add_*; the slot never changes).
- ocaml-zephyr/lib/zephyr.ml: drop [mode : Read | Write] entirely —
set at open-time, read nowhere. The open_read / open_write
constructors already distinguish the two call shapes, so mode
tracking was redundant.

New S3.Http.put_object_file takes a file path + env, computes the
SigV4 payload hash by streaming the file once through Digestif
(64 KB buffer, no heap allocation beyond the buffer), then hands
Requests.Body.of_file the same path so the HTTP layer streams the
second pass straight to the socket. A 200 MB bottle no longer has
to fit in the OCaml heap.

Sigv4.sign grows an optional ?payload_hash so callers that hash
the body out-of-band (streaming signers, aws-chunked, unsigned
payload) can override the string-based default without rewriting
the signing pipeline.

Bottler.Upload.put_both swaps Bos.OS.File.read + put_object for
put_object_file, removing the last heap-holds-entire-body
behaviour in the upload path.