[dzdidi]

Summary

• switch all six Locks Rust workspace packages from 0.1.0-rc.14 to stable 0.1.0
• switch public @synonymdev/locks-sdk metadata from RC14 to stable 0.1.0 and publish with npm latest
• update release audit, SDK release docs, and Paykit Compose smoke assertion for stable metadata

Verification

• cargo metadata --locked --no-deps --format-version 1
• cargo fmt --check
• cargo check --workspace --locked
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• npm --prefix examples/js-sdk ci
• npm --prefix locks-sdk/bindings/js test
• npm --prefix examples/js-sdk run smoke:paykit-compose
• npm --prefix locks-sdk/bindings/js run release:audit
• git diff --check 6b86a97..HEAD

Database-backed workspace/E2E tests were not rerun because this changes release metadata only.

Known release blocker

npm pack ./locks-sdk/bindings/js --dry-run --json --ignore-scripts completes, but the tarball currently contains only LICENSE, README.md, and package.json; required JS/WASM/declaration exports are absent. This does not block this metadata PR, but npm publication must remain blocked until packaging is fixed and dry-run contents are verified.

This PR does not tag, release, publish to npm, deploy, or dispatch CI manually.

[ben-kaufman]

The package README still tells users to install @synonymdev/locks-sdk@rc, so following the stable release’s installation instructions won’t select the new stable version. Could we remove @rc from locks-sdk/bindings/js/README.md as part of this change?

[dzdidi]

Fixed in 4606c0896edd0551af34a9bed67bd211326f0d67: locks-sdk/bindings/js/README.md now installs @synonymdev/locks-sdk without the stale @rc tag. Exact-head Checks and RustSec passed. Re-review requested.