feat(scaffold): match SDK v0.2.0 — Slug, v0.1.0-dev, Need callback

[I-am-nothing]

Summary

Updates the module scaffold so mirrorstack module init produces source trees that match the SDK v0.2.0 contract end-to-end. Three template fixes plus a SDK pin bump:

Change	Where	Why
Add Slug: "__MS_SLUG__" to ms.Init(ms.Config{...})	templates/module/main.go.tmpl	SDK v0.2.0 made Slug part of Config; manifest carries it from day one. The __MS_SLUG__ token was already in scaffold.rs and substituted into go.mod / response bodies — just wasn't wired into main.go's ms.Init call.
Default Versions key v0.1.0 → v0.1.0-dev	templates/module/main.go.tmpl	The -dev prerelease tag distinguishes "iterating locally" from "real release". mirrorstack publish (planned) prompts to promote it before shipping. Per docs/module-identity-and-storage-prefix.md.
Replace stale ms.DependsOn("oauth-core") doc-comment example	templates/module/main.go.tmpl	Pre-v0.2.0 bare-id form. New example uses @<owner>/<id>@<version> plus the func(n *ms.Need) { n.Table(...); n.Event(...) } callback shape — the actual contract scaffolded modules need.
Pin SDK to v0.2.0	templates/module/go.mod.tmpl	Was v0.1.1. Scaffolded modules need Need / OptionalDependOn / Config.Slug from v0.2.0 to compile.

What scaffolded modules look like now

ms.Init(ms.Config{
    ID:   "mbb8a3f8b...",       // platform-assigned UUID
    Slug: "my-module",           // catalog handle
    Name: "My Module",
    Icon: "extension",
    SQL:  sqlFS,
    Versions: map[string]system.MigrationVersions{
        "v0.1.0-dev": {App: "0001"},
    },
})

// Required deps go here — these become install-time preconditions.
// Use @<owner>/<id>@<semver> for the spec; the optional callback
// declares which relations and events this module reads from the dep.
//
//	ms.DependsOn("@anna/oauth@^1.0.0", func(n *ms.Need) {
//	    n.Table("oauth_users")
//	    n.Event("user.signed_in")
//	})

Test plan

• cargo build --all-targets clean
• cargo test --quiet clean — 64 tests pass (4 new: render_substitutes_slug_into_config_slug, render_versions_default_is_dev_prerelease, render_dependson_example_matches_v0_2_shape, render_go_mod_pins_sdk_v0_2)
• cargo clippy --all-targets -- -D warnings clean
• cargo fmt --check clean

Reviewer's quick-glance check

In templates/module/main.go.tmpl:

• Line ~31: ID: "__MS_MODULE_ID__" — unchanged
• Line ~32 (NEW): Slug: "__MS_SLUG__"
• Line ~36 (CHANGED): key is "v0.1.0-dev"
• Lines 44-54 (CHANGED): updated DependsOn example with Need callback

In templates/module/go.mod.tmpl:

• Line 7 (CHANGED): SDK pin v0.1.1 → v0.2.0

Out of scope

• mirrorstack publish command itself (planned PR 2 of module-identity-and-storage-prefix.md). The template's v0.1.0-dev default is set up for it; the publish-time -dev promotion logic lands separately.
• OptionalDependOn / OnEvent example in the events template — separate small follow-up.

🤖 Generated with Claude Code