feat: npm-tier example with no server JS and no config tag (#261)

[schloerke]

examples/11-npm-local is the Old Faithful app (app.py + app.R over one client) at the npm tier with nothing else on the page.

#264 gave npm-tier apps shinyreact_js="client", which omits shinyreact.js but still emits the #shinyreact-config tag. This app needs neither, so its whole page is:

ui = page_bare(page_react_dep(src_dir=_APP_DIR / "www", name="npm-local"))

• no shinyreact.js — one React and one hook registry on the page
• no config tag, so no protocol handshake — nothing on the page is versioned separately from the app that shipped it

The client imports @posit/shinyreact from the repo-relative file:../../pkg-js placeholder, same as examples/09-hmr, until the first npm publish.

The deletion

The config-tag strict mode is gone. It made a missing tag — or a tag with no protocolVersion — throw rather than log, but only in the npm build, on the reasoning that an independently installed client meeting a tagless page means the server predates the protocol. It also banned the simplest page there is. With nothing opting in, requireShinyReactConfigTag(), isShinyReactConfigTagRequired(), the flag and the test-only reset are removed, along with the two branches in bookmark.ts and examples/testing/mount.ts's reset call.

Unchanged: a major-version mismatch still throws visibly in both builds, and a tag with no protocolVersion still logs an error. #264's double-load warning is untouched.

Docs corrected where they justified the tag by the old behavior — page_react() / page_react_html() / set_react_page() / ReactApp() (py + R + page_react.Rd), _dep.py / dep.R, FEATURES.md: the tag is still emitted under shinyreact_js="client", but because it carries the protocol version and any bookmark restore payload, not because the client hard-errors without it.

Verification

vitest	277 passed
pytest	161 passed
testthat	270 passed
pyright / tsc / ruff / prettier	clean

Plus the app itself, driven in a browser on the Python server: page carries no shinyreact.js and no config tag, slider → server → SVG round-trips, no console errors.

Note on scope

An earlier revision of this PR shipped pkg-js/dist-npm/ inside the wheel and inst/ so an app could install @posit/shinyreact from .venv / renv (#261's actual proposal). That worked — portable lockfile, one symlink resolving for both languages — but it is not in this PR; the example uses the repo-relative placeholder instead, and #261 keeps the question. The evidence is recorded in a comment there.

[schloerke]

Rebased onto main now that #264 has landed. How the semantic conflict it flagged was resolved:

• pkg-js/src/npm.ts — kept feat: shinyreact_js= switch for npm-tier pages; convert examples/09-hmr (#217) #264's double-load console.warn, dropped requireShinyReactConfigTag(). They are independent: the warning keys off window.shinyreact, not the config tag.
• entry-parity.test.ts — feat: shinyreact_js= switch for npm-tier pages; convert examples/09-hmr (#217) #264's two warning cases and this PR's "neither entry treats a missing config tag as fatal" now coexist. 280 vitest tests pass.
• Stale rationale corrected in 5 places — page_react() / page_react_html() / set_react_page() / ReactApp() docs (py + R + page_react.Rd), _dep.py / dep.R, and FEATURES.md all said the config tag is emitted under shinyreact_js="client" because the npm client hard-errors without it. That is no longer true; the tag is still emitted either way, but the reason is now stated as what it actually carries — the protocol version and any bookmark restore payload. The behavior feat: shinyreact_js= switch for npm-tier pages; convert examples/09-hmr (#217) #264 shipped is unchanged.
• decisions/2026-08-17-js-distribution.md — merged both status updates; the "three deliberate tier distinctions" list is now two, with the dropped one and its reason recorded.

Verified after the rebase: vitest 280, pytest 161, testthat 270, pyright/tsc clean, and examples/11-npm-local re-run in a browser on the Python server — page still carries no shinyreact.js and no config tag, and no double-load warning fires.