docs(npm): revise npm-local plan for merged foundation state

What

Revisits the npm-local implementation plan (authored 2026-05-11) against what is now merged on main: S01 (HTTP server + routing), S03 (logging), S04 (database composition root), the S08 auth stub, the S06 storage interfaces + in-memory stub, the foundation schema, and the first OCI endpoint. Docs-only - no product code.

Why

The plan's dependency graph and several step descriptions assumed a pre-foundation world. Two things in particular were stale and would have misled implementation:

1. It gated npm Step 2 (schema) on S06 Step 6 (blob_storage_blobs), reasoning that blob_storage_attachments FKs into it. But blob_storage_attachments shipped without that FK (deferred per the !276 (merged) precedent), so the gate is unnecessary.
2. Several steps described a codebase shape that no longer matches what OCI actually merged (wiring, config, datastore).

Key changes

• FK-deferral (the headline). npm_files now mirrors the merged OCI container_blobs/container_manifests exactly: an active 3-column composite FK to blob_storage_attachments (id, namespace_id, sha256), plus a deferred FK to blob_storage_blobs - column ships NOT NULL + 32-byte CHECK, the referential constraint omitted with a TODO(S06-Step-6) comment, added later by S06 Step 6 via ALTER TABLE. This drops the S06-Step-6 gate; Step 2 is unblocked.
• FK arity fix. The original (id, sha256) target had no matching unique constraint on the sha256-partitioned attachments table; corrected to the 3-column form including namespace_id.
• Config (Step 3). Extend the existing internal/config loader (which already wraps labkit/v2/config + protovalidate and satisfies AC 62), not add a second loader; proto tag 3 is reserved (no DB stanza - connectivity comes from LabKit infra config).
• Datastore (Steps 4/5/18). jet + simple query protocol + per-entity store files (per ADR 023 / query-patterns), not pgx prepared statements in npm_read.go/npm_write.go.
• Wiring (Step 8). cmd/artifact-registry/wire_npm.go mirroring wire_oci.go, mounted on srv.Mux(); not a main.go RegisterRoutes(mux, deps) call.
• Migration mechanics (Steps 1/2). Real YYYYMMDDHHMMSS naming, goose NO TRANSACTION, 64-partition hash boilerplate, jet regeneration step.
• Dependencies section refreshed to the merged state with a snapshot of what is unblocked now vs. still pending (real BlobStore for the publish/cache integration steps).

Amendment statuses (re-verified)

A follow-up commit re-confirmed the spec/ADR amendments against main: MR !235 (merged) is merged, and the ADR 007 (kind=2/expires_at) and ADR 009 (-rev/{rev} routes) amendments are already synced. The only one still pending is the vary-by-visibility Cache-Control spec amendment (S11 still says private, max-age=0), which gates Steps 10/11. The Dependencies section reflects this.

Out of scope

• The maven-local plan (same divergences) - separate follow-up pass.
• The roadmap (last updated 2026-05-15) - stale but not touched here.